26 results for “Bing”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types112 Articles38 Write-ups26 Papers19 Repos15 Threads8

More types4

Advisories3 Other1 Tools1 Videos1

✍️ Write-ups “Bing”Clear all

socket.devwriteup🛡️ Security

Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users

Searchjacked is Socket's research on 319 browser extensions (about 13.44M users over a decade) that hijack searches to earn ad revenue. The fetched text attributes 200 extensions to named operators such as Intango, System1, Perion, Mutual Media and Kinner Lake, and 119 to unknown operators like "SecuryBrowse" and "Bing-Search". It lists the Yahoo and Bing monetization IDs used to link them. The narrative and technical mechanics are not in the fetched text.

Chrome Web StoreChrome

SearchjackedIntangoLumio+20

Threat Intel, Supply Chain· Published and added 29 Oct 2026

blog.talosintelligence.comwriteup🛡️ Security

Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers

Cisco Talos research on attackers using legitimate infrastructure to deliver lures, with abuse seen across more than 25 platforms in the past year. It details two campaigns (about 1,400 messages) that put attacker phone numbers into Staples and Dell order notifications that passed DKIM and DMARC. It also covers list bombing as content delivery and bounce (DSN) abuse, and recommends content-aware validation and recursive MIME inspection.

Microsoft 365Proton Mail

platform-as-a-proxylist bombingbounce abuse+7

Threat Intel, Blue Team & Detection· Published and added 21 Oct 2026

dfir.chwriteup🛡️ Security

Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow

DFIR case where a malicious MSI impersonating Advanced IP Scanner, sourced from a fake GitHub repo found via Bing, was imported by a customer into Microsoft Intune and deployed to four endpoints, running a Node.js-based EtherRAT chain. It traces the infections by correlating the MSI ProductCode, MDMAppInstaller/omadmclient process ancestry and Intune app inventory (Graph PowerShell query). It also covers renamed node.exe hash-hunting pitfalls, Ethereum RPC dead-drop C2 traffic, a screen-capture script and a second impersonating repo.

Microsoft IntuneNode.jsEthereum+3

EtherRATEtherHidingAtos Threat Research Center+4

Blue Team & Detection, Threat Intel, Malware & RE· Added 14 Oct 2026, published 13 Oct 2026

huntress.comwriteup🛡️ Security

Fake WatchGuard VPN Site Steals Credentials

Huntress analyzes an October incident where an admin searching Bing for a WatchGuard VPN download landed on watchguard-vpn[.]net, a lookalike site whose popup.js harvests Server/Login/Password, deliberately rejects the first submission to get a second set, and posts to watchguard-ssl[.]online. Unlike earlier iterations (Secplicity, Microsoft Storm-2561), the final payload is the genuine, validly signed WatchGuard installer from the official CDN, so no malware is present for endpoint tools to flag. Covers infrastructure timeline, thin VirusTotal detections, and defender guidance (MFA, monitoring VPN logins from hosting ASNs, blocking domains, publishing official download links).

WatchGuardVPNHuntress+2

Storm-2561SEO poisoningwatchguard-vpn[.]net+5

Threat Intel, Blue Team & Detection· Added 14 Oct 2026, published 13 Oct 2026

ethereum-magicians.orgwriteup🛡️ Security

Bend-SSZ: Formally proving SSZ

A forum writeup describing bend-ssz, a formally verified implementation of Ethereum's SSZ serialization covering all 109 mainnet Fulu types plus 131 generic test forms, written in the proof-checking language Bend and proved equal to the consensus-specs reference instead of relying on test vectors. The post details how mutation testing, hand-written fault injection, and 2M+ hostile decode fuzzing found and closed gaps, including a 32-bit size-arithmetic wraparound and a decode memory-amplification DoS (up to 28x heap-per-byte blowup) that is mitigated with a proved, budgeted decode function; it also reports integrating the library into Prysm and cross-checking against Lighthouse on a live devnet with zero mismatches.

EthereumBendSSZ+3

Fuluconsensus-specsBeaconState+2

Blockchain, AppSec· Published and added 4 Oct 2026

github.comwriteup🛡️ Security

Xray-core concealed a certificate verification bypass vulnerability

A security researcher's first-person disclosure describing a certificate verification bypass in Xray-core (a popular censorship-circumvention proxy): when its pinnedPeerCertSha256 option skips regular TLS verification, a MITM attacker can insert a leaf certificate anywhere in the certificate chain and have the custom pinning logic incorrectly validate it, effectively eliminating certificate verification. The writeup also documents how the vulnerability was silently fixed with a misleading "simplify the code" commit message and left undisclosed to users for nearly half a year until the reporter filed a GitHub Security Advisory.

Xray-core

pinnedPeerCertificateChainSha256pinnedPeerCertSha256allowInsecure+1

AppSec· Added 5 Oct 2026, published 4 Oct 2026

ethresear.chwriteup🛡️ Security

Six defects in one signature verification tool, found from outside in six rounds

A forum writeup on ethresear.ch describing a "predictions-first" testing methodology for verification logic, applied against the author's own repository and against a live third-party MCP server (nsgoods Workbench, which offers offline signature verification over the x402 payment catalogue). Six rounds of testing surfaced concrete defects: a false negative caused by a stripped field list, a tamper-accepted body via a service-selection parameter that let callers choose which fields were excluded from the signed message, schema-rejection and signature-failure returning byte-identical error text, and a logging/privacy gap in the operator's system that was fixed after disclosure. The author ships a companion tool, exactzk-verification-guards, which captures both a passing and an actually-reproduced failing run as regression evidence rather than a fabricated example.

Model Context ProtocolGitHubnsgoods Workbench MCP+1

x402ERC-8004Nikolaos Dimitriadis

AppSec· Published and added 2 Oct 2026

binsec.nowriteup🛡️ Security

Binary Security: Azure Logic Apps cross-tenant compromises (One Root Case)

Third post in a series on Azure Logic Apps API Connections, describing five critical cross-tenant privilege escalations that let an attacker use any other tenant's connection to reach its backend (Key Vault, Azure SQL, Jira, Salesforce). Techniques include path traversal via ARM DynamicInvoke and undocumented DynamicList endpoints, and abusing the host.api.runtimeUrl parameter in Consumption Logic Apps, including a validation-before-normalization bypass. The author reports $200,000 in bounties; Microsoft fixed all issues.

AzureAzure Logic AppsAzure API Management+3

path traversalDynamicInvokeDynamicList+5

Cloud & Infra, AppSec, Offensive Security· Added 30 Oct 2026, published 2 Oct 2026

dfir.chwriteup🛡️ Security

Field Notes: From AV Alert to Impacket

A DFIR field notes post describing how an analyst pivoted from a Microsoft Defender "Behavior:Win32/RegDump.SA" alert (flagged on svchost.exe running as SYSTEM) to identify Impacket's secretsdump.py activity. MFT analysis revealed a leftover temp file (ASOWCIKI.tmp) matching Impacket's RemoteOperations naming pattern (8 random ASCII chars + .tmp) for a partially-saved SAM registry hive, and the post explains why svchost.exe appears in telemetry due to the Remote Registry service being abused over MS-RRP/winreg via SMB. It also cross-references a similar Huntress case (April 2026) that additionally observed SCM Event ID 7040 (Remote Registry service enabled) as a corroborating artifact.

ImpacketMicrosoft DefenderHuntress+1

Behavior:Win32/RegDump.SAsecretsdump.pyMS-RRP+3

Blue Team & Detection· Added 13 Sep 2026, published 11 Sep 2026

huggingface.cowriteup🧠 AI

Async GRPO with LoRA across HF Jobs: a bucket, a proxy, and no NCCL

A Hugging Face engineering blog post describing how TRL's AsyncGRPOTrainer now syncs only a LoRA adapter (not full weights) to vLLM, letting trainer and inference replicas run as separate Hugging Face Jobs connected via a Storage Bucket instead of NCCL. It details a custom proxy that adds auth headers, routes rollouts to the vLLM replica most likely to hold the matching KV-cache prefix, and broadcasts adapter loads atomically across replicas. Five iterative runs (token-budget batching, disabling gradient checkpointing, raising in-flight caps) cut a 500-step Qwen2.5-Math-1.5B GRPO run from 3h27m to 53 minutes.

Hugging FacevLLMLoRA+4

TRLAsyncGRPOTrainerHugging Face Jobs+10

training, inference, ai-infra· Added 29 Sep 2026, published 10 Sep 2026

stepsecurity.iowriteup🛡️ Security

@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow

StepSecurity documents how an external GitHub user (p00paboot) hijacked the release workflow of @7nohe/openapi-react-query-codegen by exploiting an npm publish issue-comment trigger that lacked commenter authorization checks, allowing pull-request code to be checked out and published via GitHub Actions OIDC trusted publishing. Ten malicious versions were pushed with preinstall hooks and a poisoned binding.gyp that executed a payload downloading Bun, stealing GitHub/git credentials, probing GCP metadata, and enumerating SSH keys, confirmed via StepSecurity Harden-Runner behavioral analysis on isolated runners. The post lists affected versions, file/hash IOCs, and remediation steps including credential rotation and pinning to clean releases.

npmGitHub ActionsBun+3

StepSecurityHarden-Runner@7nohe/openapi-react-query-codegen+2

Supply Chain, DevSecOps· Added 3 Sep 2026, published 28 Aug 2026

theravenfile.comwriteup🛡️ Security

VEEAM UNDER FIRE: Understanding CVE-2026–44963 & Ransomware Group Exploit Claims

Analysis of CVE-2026-44963, a critical (CVSS 9.4) unsafe-deserialization RCE in Veeam Backup & Replication 12.x rooted in BinaryFormatter/.NET Remoting that lets any low-privilege domain user gain SYSTEM-level control of domain-joined backup servers; fixed in 12.3.2.4854. The author correlates it with a 2025 "Bug of June 2025" exploit sale, documents a Lynx Ransomware Group negotiation describing exploitation to create local admin accounts and dump domain credentials, covers an underground forum ad claiming an unauthenticated patch-bypass 0-day, and includes a Veeam-specific attacker TTP matrix (e.g. CVE-2023-27532 credential harvesting) plus defense recommendations.

Veeam Backup & Replication.NET

CVE-2026-44963CVE-2024-40711CVE-2023-27532+8

Threat Intel, AppSec, Offensive Security· Added 3 Sep 2026, published 20 Aug 2026

xbow.comwriteup🛡️ Security

XBOW: A Shell Is Worth a Thousand Images

XBOW's autonomous AI agent chained a blind SSRF in Bing's reverse-image-search into three Critical Microsoft RCEs (CVE-2026-32194, CVE-2026-32191, CVE-2026-21536), each CVSS 9.8, by fingerprinting an ImageMagick-compatible backend through differential error responses and crafting an SVG payload that reached a shell-backed image delegate. The proof was confirmed via out-of-band callbacks showing NT AUTHORITY\SYSTEM and root execution across multiple production Bing image-processing workers on both Windows and Linux hosts. The piece walks through the full investigative trace — from ruling out XXE to fingerprinting ImageMagick coders/pseudo-protocols to constructing the pipe-based SVG exploit — and argues that ImageTragick-class bugs in "boring" image helpers remain a live, underrated attack surface.

XBOWImageMagickBing+1

CVE-2026-32194CVE-2026-32191CVE-2026-21536+3

AppSec, AI Security, Offensive Security· Published and added 8 Aug 2026

blacksnufkin.github.iowriteup🛡️ Security

Hunting the Hunter: A Live Kernel LPE 0day in Anti-Cheat on a Billion Machines

A technical writeup by security researcher BlackSnufkin describing the discovery of a live, unpatched 0day kernel-mode local privilege escalation (LPE) vulnerability in an anti-cheat driver reportedly deployed on roughly a billion Windows machines. The post likely covers the vulnerability research and exploitation process targeting the anti-cheat's kernel component. Full page content could not be verified in this pass; summary is inferred from title and URL alone.

Windows

Offensive Security· Added 2 Oct 2026, published 4 Aug 2026

blog.trailofbits.comwriteup🛡️ Security

How we use /goal to find bugs in Patch the Planet

Trail of Bits describes how they use Codex's /goal feature, an open-ended agentic objective mode, to hunt for bugs in heavily audited open-source codebases like Rust, curl, and zlib as part of the OpenAI-backed Patch the Planet initiative. Key techniques include letting Codex write and red-team its own goal prompts, defining precise outcomes rather than prescribing methods, running one outcome per agent to avoid competing objectives, and building an automated variant-analysis pipeline (using P-critical Rust issues, a security gate, and a two-pass false-positive judge) that produced a soundness hole and a miscompilation patched in Rust 1.98, plus privilege-escalation bugs in Keycloak's SAML component. They also built agentcov, an internal tool that tracks code coverage read by Codex to prevent it from skipping parts of the codebase.

CodexRustcurl+3

Patch the PlanetTrail of BitsKevin Valerio+2

AI Security, AppSec· Added 3 Sep 2026, published 28 Jul 2026

dfir.chwriteup🛡️ Security

Field Notes: NSSM - the Non-Sucking Service Manager

A DFIR field notes post describing how attackers abuse NSSM (Non-Sucking Service Manager) to run tools like ngrok as a Windows service, hiding the real executable behind the legitimate nssm.exe ImagePath. It walks through hunting techniques: checking Event ID 7045 service-installation logs, inspecting the service's registry Parameters subkey to reveal the true application/arguments, and confirming via live process command-line analysis (Process Explorer, Velociraptor's Windows.System.Pslist), illustrated with a second real case where nssm.exe was wrapping a "komari-agent" implant.

WindowsVelociraptorngrok

komari-agentEvent ID 7045

Blue Team & Detection· Added 3 Sep 2026, published 27 Jul 2026

wiz.iowriteup🛡️ Security

Red Agentの視点：いかにして推論を重ねてSSRFへと至ったか

Wiz walks through how its autonomous 'Red Agent' AI pentesting tool chained an SSRF vulnerability in a GCP Cloud Run service's ?url= file-fetch parameter into a full local file read, bypassing a strict GitHub-blob-URL validator. The breakthrough payload (github.com/x/y/blob/z//proc/self/environ) exploited a parser differential between the validator and the fetcher, letting the agent exfiltrate live GCP service-account credentials and the app's source code after 96 requests of iterative hypothesis-driven probing.

GCPWiz

Red AgentSSRFpath traversal

AppSec, AI Security, Cloud & Infra· Added 3 Sep 2026, published 17 Jun 2026

varonis.comwriteup🛡️ Security

SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon

Varonis Threat Labs details SearchLeak, a three-stage exploit chain (CVE-2026-42824, critical) that abuses Microsoft 365 Copilot Enterprise Search: a Parameter-to-Prompt (P2P) injection via the search URL's `q` parameter turns a clicked link into an AI instruction, an HTML-rendering race condition lets an injected `<img>` tag fire before Copilot's `<code>`-block sanitizer applies, and Bing's "Search by Image" endpoint (allowlisted in the CSP) performs a server-side fetch that exfiltrates the stolen data to an attacker's server. A single click on a trusted microsoft.com link lets an attacker silently exfiltrate emails, security codes, calendar data, and SharePoint/OneDrive content with the victim's full Graph permissions, no plugins or extra permissions required. Microsoft has patched the issue; the post is a follow-up to Varonis' earlier "Reprompt" finding in Copilot Personal.

Microsoft 365Bing

CVE-2026-42824RepromptSSRF+1

AI Security, AppSec· Added 16 Jun 2026, published 15 Jun 2026

dfir.chwriteup🛡️ Security

Anatomy of a Deno-Based Proxy & RAT

InfoGuard LABS DFIR analysis of an intrusion that combined mailbombing and Microsoft Teams IT-support impersonation to deliver a modular Deno-based RAT and network proxy. The malware splits functionality across four JavaScript files (app.js, back.js, helper.js, webui.js) that abuse Deno's permission model, use string-array-shifting obfuscation, communicate C2 over a CloudFront-fronted WebSocket, and expose loopback HTTP services for command execution (127.0.0.1:10021) and TCP tunneling/pivoting (127.0.0.1:10022). The post details persistence via the HKCU Run key, Teams impersonation telemetry (TeamsImpersonationDetected), and provides KQL hunting queries for Deno execution flags, CloudFront C2 traffic, and registry persistence.

DenoWindowsMicrosoft Teams+3

TeamsImpersonationDetectedd2cff16eusb8mg.cloudfront.netmailbombing

Malware & RE, Blue Team & Detection· Added 3 Sep 2026, published 15 Jun 2026

xbow.comwriteup🛡️ Security

XBOW: Dead.Letter (CVE-2026-45185)

XBOW's detailed technical writeup on CVE-2026-45185, a critical unauthenticated remote-code-execution vulnerability in Exim triggered by a use-after-free during GnuTLS TLS shutdown: Exim frees its xfer_buffer while a nested BDAT chunking receive wrapper can still call the stale tls_ungetc(), writing a single newline byte into freed memory that lands on allocator metadata and escalates to RCE. The post walks through Exim's SMTP/BDAT/TLS receive-callback plumbing and its custom store pool allocator in detail, then narrates a seven-day disclosure-window contest where the researcher (assisted by an LLM) and XBOW's autonomous exploit-development harness raced to build a working exploit chain (glibc largebin corruption, hijacking a malloc call via Exim's spool fdopen, and overwriting a FILE struct) against progressively hardened builds.

EximGnuTLSClaude Code

CVE-2026-45185XBOW

AppSec, Offensive Security, AI Security· Published and added 13 May 2026

jakobfriedl.github.iowriteup🛡️ Security

Extending Conquest using Python Modules

A technical blog post describing how to extend the Conquest tool's capabilities by writing custom Python modules, likely covering the module interface, loading mechanism, and example extensions. The specific functionality and scope of Conquest itself could not be verified in this pass since the page content failed to process.

Python

Offensive Security· Added 2 Oct 2026, published 13 Mar 2026

huntress.comwriteup🛡️ Security

How the Huntress SOC Stopped a VPN-Based Ransomware Attack

Huntress SOC incident writeup describing how attackers breached a small US construction manufacturer via a VPN lacking two-factor authentication, then used RDP for reconnaissance, dumped credentials after lateral movement, and attempted to disable Microsoft Defender and the Huntress EDR agent. The SOC's triage, support, and tactical response teams detected the activity via Managed EDR, isolated the network, reviewed VPN logs, and remediated by disabling compromised accounts and enabling 2FA before ransomware deployment occurred.

VPNRDPMicrosoft Defender+2

Blue Team & Detection, Identity & Access· Added 3 Sep 2026, published 13 Mar 2026

huntress.comwriteup🛡️ Security

How Fake OpenClaw Installers Spread GhostSocks Malware

Huntress investigated malicious GitHub repositories impersonating OpenClaw installers (Feb 2-10, 2026) that were surfaced as the top Bing AI search result for "OpenClaw Windows." The Windows installer deployed a new packer dubbed Stealth Packer alongside Vidar and PureLogs infostealers and GhostSocks — a BlackBasta-linked SOCKS backconnect proxy malware that routes attacker traffic through the victim's machine to bypass MFA and anti-fraud checks — while a parallel macOS campaign delivered a signed Mach-O AMOS stealer variant via a fake "puppeteerrr/dmg" repo, later detected by an Apple XProtect update. The blog includes full technical teardown, GitHub account/organisation abuse patterns, and IOCs.

OpenClawGitHubWindows+3

GhostSocksVidarPureLogs Stealer+4

Threat Intel, Malware & RE· Added 3 Sep 2026, published 4 Mar 2026

huntress.comwriteup🛡️ Security

Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?

A Huntress blog post (part one of a series) describing how Velociraptor, a DFIR/endpoint forensics and hunting tool, can be misused alongside WSUS (Windows Server Update Services) for offensive purposes, such as living-off-the-land style abuse or lateral movement. The fetched content only contained site navigation, not the article body, so specific technical details (exploitation steps, payloads, detection guidance) could not be confirmed.

VelociraptorWSUS

Offensive Security, Blue Team & Detection· Added 3 Sep 2026, published 20 Nov 2025

bencteux.frwriteup🛡️ Security

Detecting insiders on GNU/Linux servers

A practical guide to building an auditd-based Linux intrusion detection ruleset covering reconnaissance (tcpdump/wireshark/nmap install and execution), privilege escalation (setuid/setgid syscalls, sudoers and /etc/passwd modification, process injection via ptrace and process_vm_writev), container escape via host filesystem remounting, lateral movement (xfreerdp), persistence (SSH authorized_keys, cron, systemd units, udev rules), and detection evasion via /dev/shm. Each rule is accompanied by working C PoCs and ausearch log output to validate detection, plus discussion of auditd's limitations (no path globbing, kernel syscalls only, incomplete file-change detection). Based on the author's incident response and pentesting experience, the rules and full ruleset are published on a companion GitHub repo.

auditdLinuxNmap+3

Blue Team & Detection· Added 3 Sep 2026, published 21 Apr 2025

hausec.comwriteup🛡️ Security

Using a C# Shellcode Runner and ConfuserEx to Bypass UAC

A red-team engagement writeup describing how to convert djhohenstein's CSharp SetThreadContext shellcode runner into a DLL, using the DllExport NuGet package and x64 Release build settings, so it can be loaded via rundll32.exe. The DLL and a modified chryzsh Aggressor script implementing the SilentCleanup scheduled-task DLL-hijack UAC bypass are then run through ConfuserEx to evade Windows Defender detection, enabling a Cobalt Strike beacon to escalate from a medium-integrity to high-integrity token without a UAC prompt.

Cobalt StrikeWindows Defender.NET+3

SilentCleanup UAC bypassUACMEConfuserEx+1

Offensive Security· Added 3 Sep 2026, published 30 Oct 2020