--- title: "Cybersecurity Blog & Security Research | ADAMnetworks" description: "Read ADAMnetworks security research, technical articles, and company announcements covering Zero Trust Connectivity, DNS, ransomware, IoT, and AI." url: https://adamnet.works/blog/ index: https://adamnet.works/llms.txt --- Research & Perspectives # ADAMnetworks Blog Security research, technical perspectives, and company announcements from the team building practical Zero Trust Connectivity. [All posts](https://adamnet.works/blog.md) [Security Research](https://adamnet.works/blog/security-research.md) [Articles](https://adamnet.works/blog/articles.md) [Announcements](https://adamnet.works/blog/announcements.md) [RSS](https://adamnet.works/rss.xml) Latest in Security Research ## KeyStealth: Device code phishing to rogue Entra devices and BEC A construction quote lure led to device code phishing, three rogue Entra devices named iAuthFlow-Device, and seven weeks of mail access before a thread hijack. October 22, 2026 · Kirk | ADAMnetworks [Read the post](https://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec.md) Deep dives ## [Security Research](https://adamnet.works/blog/security-research.md) Original technical analysis of active threats, vulnerable systems, and defensive architecture. [View all 6 Security Research posts](https://adamnet.works/blog/security-research.md)[](https://adamnet.works/blog/security-research/rss.xml) ## [ValleyRAT hides behind a Microsoft profiler and a 19-byte text file](https://adamnet.works/blog/valleyrat-signed-profiler-and-19-byte-text-file.md) October 22, 2026 · Kirk | ADAMnetworks Tax-themed ISOs sideload ValleyRAT through a signed Visual Studio tool. Five months of builds share one transport key and a text file that hands out new servers. ValleyRAT · DLL Sideloading · +1 Read more ## [A ClickFix loader rewritten to get past a rival's page cleaner](https://adamnet.works/blog/a-clickfix-loader-rewritten-to-get-past-a-rival-s-page-cleaner.md) October 13, 2026 · Kirk | ADAMnetworks Two ClickFix kits fought over the same screen on hacked WordPress sites. One wrote the fight into its code, in Russian, down to the moment the browser broke. ClickFix · WordPress · +2 Read more ## [Brevo delivered ClickFix through its own infrastructure](https://adamnet.works/blog/brevo-delivers-kongtuke-clickfix-to-customer-sites.md) September 16, 2026 · Kirk | ADAMnetworks Brevo served KongTuke ClickFix from its own infrastructure. Altered tracker scripts, forms, and unsubscribe pages delivered the attack to customer sites. ClickFix · KongTuke · +2 Read more ## [HBO Max ads exposed the PasteSwitch ClickFix operation](https://adamnet.works/blog/hbo-max-ads-exposed-the-pasteswitch-clickfix-operation.md) September 13, 2026 · Kirk | ADAMnetworks A compromised HBO Max Reddit account led to PasteSwitch, a cross-platform ClickFix operation spanning macOS stealers, Windows loaders, deceptive TLS, and contract-controlled clippers. ClickFix · PasteSwitch · +2 Read more ## [When IoT Becomes Attack Infrastructure: From Mirai to RondoDox and the Case for Zero Trust Connectivity](https://adamnet.works/blog/when-iot-becomes-attack-infrastructure-mirai-rondodox-zero-trust-networking.md) August 20, 2026 · Kirk | ADAMnetworks A 99 KB Mirai-derived sample scanned 238,756 hosts in 149 seconds. RondoDox shows how Zero Trust Connectivity can contain compromised IoT devices. IoT Security · Botnets · +3 Read more Perspectives ## [Articles](https://adamnet.works/blog/articles.md) Technical perspectives on DNS, Zero Trust Connectivity, and modern network defense. [View all 24 Articles posts](https://adamnet.works/blog/articles.md)[](https://adamnet.works/blog/articles/rss.xml) ## [Faster Than Real-Time? Why Your Security Fails and What to Do Next](https://adamnet.works/blog/faster-than-real-time.md) November 10, 2025 · Francois Driessen | ADAMnetworks At GITEX 2025, Spire Connect’s Pankaj Sharma asked Francois Driessen what to do when security systems fail. Why even real-time detection is too slow, and how Zero Trust Connectivity denies connections first. Zero Trust Connectivity · Interview · +1 Read more ## [Preventing DNS Filtering Bypass by Encrypted DNS (DoT, DoH, DoQ)](https://adamnet.works/blog/preventing-encrypted-dns-filtering-bypass.md) October 31, 2025 · David Redekop | ADAMnetworks Encrypted DNS hides queries from protective DNS policy. A lab walk-through of Do53, direct-to-IP and allowed DoH URL bypass attempts, and how a local Zero Trust Resolver keeps encryption and enforcement together. Encrypted DNS · DoH · +1 Read more ## [DTTS | Zero Trust DNS Enforcement: Policy Violation Management](https://adamnet.works/blog/dtts-policy-violation-management.md) October 23, 2025 · David Redekop | ADAMnetworks In a default-deny network, legacy apps, VoIP and peer-to-peer tools and time-bound connections can fail DTTS checks. The three categories of violation, how traffic logs show them, and how Enablers grant exceptions. DTTS · Zero Trust DNS · +1 Read more ## [Purdue 2.0? Rising to the Challenge to Secure OT with Zero Trust Connectivity](https://adamnet.works/blog/purdue-2-0-securing-ot-with-zero-trust-connectivity.md) October 8, 2025 · Francois Driessen | ADAMnetworks OT environments face organized crime, nation-state attacks and IT/OT convergence that the Purdue Model and IEC 62443 alone cannot stop. How Zero Trust Connectivity controls egress at every level, with four test cases. OT Security · Purdue Model · +1 Read more ## [DNS TXT Records: The Swiss Army Knife of Domain Data](https://adamnet.works/blog/dns-txt-records.md) August 15, 2025 · David Redekop | ADAMnetworks DNS TXT records carry SPF, DKIM and verification data, and now malware and C2 traffic too. Passive DNS analysis of who needs TXT answers, and how adam:ONE blocks them for risky endpoints while allowing the rest. DNS TXT · Malware · +1 Read more ## [Endpoint Adoption of Encrypted DNS](https://adamnet.works/blog/endpoint-adoption-of-encrypted-dns.md) June 19, 2025 · David Redekop | ADAMnetworks A hands-on test of how far Windows, Android and iOS have adopted encrypted DNS through DDR and DNR, with the adam:ONE lab setup, the queries each platform sends, and what administrators can enable today. Encrypted DNS · DDR · +1 Read more Company news ## [Announcements](https://adamnet.works/blog/announcements.md) Product launches, industry recognition, and important updates from ADAMnetworks. [View all 16 Announcements posts](https://adamnet.works/blog/announcements.md)[](https://adamnet.works/blog/announcements/rss.xml) ## [ClickNix: a free browser extension that stops ClickFix attacks before they reach the user](https://adamnet.works/blog/clicknix-launch.md) October 9, 2026 · ADAMnetworks We released ClickNix, a free browser extension that blocks ClickFix content before it is shown, warns the visitor, and reports the compromised site to a shared defense network. ClickNix · ClickFix · +1 Read more ## [ADAMnetworks and VyOS partner to add Zero Trust Connectivity to the VyOS networking platform](https://adamnet.works/blog/vyos-partnership.md) September 17, 2026 · ADAMnetworks Our technology partnership with VyOS Networks layers adam:ONE, our Zero Trust resolver, onto the VyOS networking platform to secure cloud infrastructure, on-premises operations and remote access traffic. VyOS · Zero Trust Connectivity · +1 Read more ## [Philippe Johnston joins ADAMnetworks as Field CIO and Strategic Advisor](https://adamnet.works/blog/philippe-johnston-field-cio.md) June 12, 2026 · ADAMnetworks Philippe Johnston, a former CIO and CTO across Canadian federal departments and past President of the CIO Association of Canada, has joined us as Field CIO and Strategic Advisor. Leadership · Preemptive Security · +1 Read more ## [Underminr: a shared hosting vulnerability affecting around 88 million domains](https://adamnet.works/blog/underminr-shared-hosting-vulnerability.md) May 21, 2026 · ADAMnetworks We uncovered Underminr, a vulnerability in how large hosting providers handle internet-bound connections. Attackers use it to evade protective DNS when reaching C2 or exfiltrating data, and it is under active exploit. Underminr · Domain Fronting · +2 Read more ## [Spire Solutions to distribute adam:ONE across the Middle East and Africa](https://adamnet.works/blog/spire-solutions-partnership.md) November 26, 2025 · ADAMnetworks We have formed a distribution partnership with Spire Solutions, a value-added distributor in the Middle East and Africa, to bring adam:ONE and Zero Trust Connectivity (ZTc) to enterprises, governments and critical sectors in more than 10 countries. Spire Solutions · Middle East and Africa · +2 Read more ## [ONE9 releases a featurette on ADAMnetworks: From Reactive to Proactive](https://adamnet.works/blog/one9-featurette.md) October 6, 2025 · ADAMnetworks ONE9 released a featurette on ADAMnetworks, From Reactive to Proactive: A New Cybersecurity Philosophy, covering adam:ONE and Zero Trust Connectivity. The video and full transcript are on our site. ONE9 · Zero Trust Connectivity · +1 Read more