---
title: "Security Research & Threat Analysis | ADAMnetworks"
description: "Original ADAMnetworks research into active threats, malware campaigns, and vulnerable systems, with the evidence behind each finding."
url: https://adamnet.works/blog/security-research/
index: https://adamnet.works/llms.txt
---

Deep dives

# Security Research

Original technical analysis of active threats, vulnerable systems, and defensive architecture.

[All posts](https://adamnet.works/blog.md) [Security Research](https://adamnet.works/blog/security-research.md) [Articles](https://adamnet.works/blog/articles.md) [Announcements](https://adamnet.works/blog/announcements.md)

1–6 of 6

[RSS](https://adamnet.works/blog/security-research/rss.xml)

## [KeyStealth: Device code phishing to rogue Entra devices and BEC](https://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec.md)

October 22, 2026 · Kirk | ADAMnetworks

A construction quote lure led to device code phishing, three rogue Entra devices named iAuthFlow-Device, and seven weeks of mail access before a thread hijack.

Device Code Phishing · Microsoft Entra ID · +2

Read more

## [ValleyRAT hides behind a Microsoft profiler and a 19-byte text file](https://adamnet.works/blog/valleyrat-signed-profiler-and-19-byte-text-file.md)

October 22, 2026 · Kirk | ADAMnetworks

Tax-themed ISOs sideload ValleyRAT through a signed Visual Studio tool. Five months of builds share one transport key and a text file that hands out new servers.

ValleyRAT · DLL Sideloading · +1

Read more

## [A ClickFix loader rewritten to get past a rival's page cleaner](https://adamnet.works/blog/a-clickfix-loader-rewritten-to-get-past-a-rival-s-page-cleaner.md)

October 13, 2026 · Kirk | ADAMnetworks

Two ClickFix kits fought over the same screen on hacked WordPress sites. One wrote the fight into its code, in Russian, down to the moment the browser broke.

ClickFix · WordPress · +2

Read more

## [Brevo delivered ClickFix through its own infrastructure](https://adamnet.works/blog/brevo-delivers-kongtuke-clickfix-to-customer-sites.md)

September 16, 2026 · Kirk | ADAMnetworks

Brevo served KongTuke ClickFix from its own infrastructure. Altered tracker scripts, forms, and unsubscribe pages delivered the attack to customer sites.

ClickFix · KongTuke · +2

Read more

## [HBO Max ads exposed the PasteSwitch ClickFix operation](https://adamnet.works/blog/hbo-max-ads-exposed-the-pasteswitch-clickfix-operation.md)

September 13, 2026 · Kirk | ADAMnetworks

A compromised HBO Max Reddit account led to PasteSwitch, a cross-platform ClickFix operation spanning macOS stealers, Windows loaders, deceptive TLS, and contract-controlled clippers.

ClickFix · PasteSwitch · +2

Read more

## [When IoT Becomes Attack Infrastructure: From Mirai to RondoDox and the Case for Zero Trust Connectivity](https://adamnet.works/blog/when-iot-becomes-attack-infrastructure-mirai-rondodox-zero-trust-networking.md)

August 20, 2026 · Kirk | ADAMnetworks

A 99 KB Mirai-derived sample scanned 238,756 hosts in 149 seconds. RondoDox shows how Zero Trust Connectivity can contain compromised IoT devices.

IoT Security · Botnets · +3

Read more