Original ADAMnetworks research into active threats, malware campaigns, and vulnerable systems, with the evidence behind each finding.https://adamnet.works/blog/security-research/en-UShttps://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec/https://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec/A construction quote lure led to device code phishing, three rogue Entra devices named iAuthFlow-Device, and seven weeks of mail access before a thread hijack.Thu, 22 Oct 2026 00:00:00 GMTSecurity ResearchDevice Code PhishingMicrosoft Entra IDBusiness Email CompromisePhishing-as-a-Servicehttps://adamnet.works/blog/valleyrat-signed-profiler-and-19-byte-text-file/https://adamnet.works/blog/valleyrat-signed-profiler-and-19-byte-text-file/Tax-themed ISOs sideload ValleyRAT through a signed Visual Studio tool. Five months of builds share one transport key and a text file that hands out new servers.Thu, 22 Oct 2026 00:00:00 GMTSecurity ResearchValleyRATDLL SideloadingRemote Access Trojanshttps://adamnet.works/blog/a-clickfix-loader-rewritten-to-get-past-a-rival-s-page-cleaner/https://adamnet.works/blog/a-clickfix-loader-rewritten-to-get-past-a-rival-s-page-cleaner/Two ClickFix kits fought over the same screen on hacked WordPress sites. One wrote the fight into its code, in Russian, down to the moment the browser broke.Tue, 13 Oct 2026 00:00:00 GMTSecurity ResearchClickFixWordPressOverlayWarGuardFramehttps://adamnet.works/blog/brevo-delivers-kongtuke-clickfix-to-customer-sites/https://adamnet.works/blog/brevo-delivers-kongtuke-clickfix-to-customer-sites/Brevo served KongTuke ClickFix from its own infrastructure. Altered tracker scripts, forms, and unsubscribe pages delivered the attack to customer sites.Wed, 16 Sep 2026 00:00:00 GMTSecurity ResearchClickFixKongTukeBrevoMintsLoaderhttps://adamnet.works/blog/hbo-max-ads-exposed-the-pasteswitch-clickfix-operation/https://adamnet.works/blog/hbo-max-ads-exposed-the-pasteswitch-clickfix-operation/A compromised HBO Max Reddit account led to PasteSwitch, a cross-platform ClickFix operation spanning macOS stealers, Windows loaders, deceptive TLS, and contract-controlled clippers.Sun, 13 Sep 2026 00:00:00 GMTSecurity ResearchClickFixPasteSwitchMalvertisingmacOS Stealershttps://adamnet.works/blog/when-iot-becomes-attack-infrastructure-mirai-rondodox-zero-trust-networking/https://adamnet.works/blog/when-iot-becomes-attack-infrastructure-mirai-rondodox-zero-trust-networking/A 99 KB Mirai-derived sample scanned 238,756 hosts in 149 seconds. RondoDox shows how Zero Trust Connectivity can contain compromised IoT devices.Thu, 20 Aug 2026 00:00:00 GMTSecurity ResearchIoT SecurityBotnetsMiraiRondoDoxZero Trust Connectivity