John Fitzpatrick [AnyDesk TAG] AnyDesk and ScreenConnect in a campaign targeting banking customers Write-up of a live campaign utilising legitimate AnyDesk and ScreenConnect tooling to target banking customers AnyDesk Banking Fraud Investigation
John Fitzpatrick Pre-Attack Indicators Pre-Attack Indicators describe adversarial infrastructure identified before it is used. We explain why we're using PAI and how it differs from an IOC. IOC PAI Pre-Attack Indicators
John Fitzpatrick FulcrumSec - A look at their tradecraft A closer look at how FulcrumSec finds exposed credentials, expands access through cloud and SaaS environments, and what their activity tells us about where defenders should be looking. FulcrumSec Tradecraft
John Fitzpatrick From Ethereum to DNS C2: Reverse Engineering the ClickFix Payload Inside the ClickFix payload: how DeviceManager uses Ethereum to locate its C2, communicate over DNS and maintain persistent access. C2 ClickFix EtherHiding Malware
John Fitzpatrick From Compromised WordPress Sites to Blockchain-Backed Malware A technical look at a ClickFix campaign using compromised WordPress sites, Ethereum-backed JavaScript, PowerShell and Cloudflare R2 to deliver malware. ClickFix EtherHiding
John Fitzpatrick IPv6 Trends in User Account Compromises We look at how adversaries are exploiting the vast IPv6 address space to sidestep IP reputation controls during account takeover attacks. Account Compromise Authentication IPv6
John Fitzpatrick What I Learned from Sitting in on a Scattered Spider Sentencing Last week I spent a morning sitting in the public gallery at Woolwich Crown Court, watching the sentencing of Owen Flowers and Thalha Jubair - two prominent members of the notorious Scattered Spider c... scattered spider
John Fitzpatrick When DMCA Comes Knocking - Part 2: The Sign-in Window That Isn't The second of two posts on a DMCA themed phishing kit targeting YouTube creators. In this post we focus in on the Browser in The Browser (BiTB) component and the effort put into getting the polish just right... AiTM BitB Phishing
John Fitzpatrick When DMCA Comes Knocking - A YouTube Creator Phishing Kit, Part 1 This is the first of two posts on a DMCA-themed phishing kit we've been looking at recently. The kit goes after creator accounts on platforms that issue copyright complaints. This post covers the fron... AiTM BitB Phishing
Oleksandr Vengeruk Blob URLs - The Phishing Disguise Hiding in Your Browser Blob URLs - The Phishing Disguise Hiding in Your Browser In recent months we started noticing a growing number of phishing websites abusing a legitimate technology; Blob URLs. While these are not new,... AiTM Phishing
John Fitzpatrick Tycoon2FA is Down - What Happens Next? On March 4th 2026, a Europol-led coalition took down Tycoon2FA -one of the largest adversary-in-the-middle (AiTM) phishing-as-a-service platform in operation. At its p... AiTM Tycoon2FA
John Fitzpatrick Starkiller - A Reminder That a Residential Proxy Strategy is Needed Starkiller markets itself as an "Advanced Phishing Framework" with bold claims: 99.7% success rate, 0% detection rate. Having comprehensively mapped their infrastructure we... AiTM proxies starkiller
![[AnyDesk TAG] AnyDesk and ScreenConnect in a campaign targeting banking customers](/web/image/blog.post/22/author_avatar/%5BAnyDesk%20TAG%5D%20AnyDesk%20and%20ScreenConnect%20in%20a%20campaign%20targeting%20banking%20customers?unique=542585f)
