Technical analyses and practical guides on cyber threats from the Hard2bit team: 24/7 SOC, pentesting, compliance and incident response.
Active campaigns, emerging techniques and CVE analyses with real impact. Not headline coverage — vector breakdown, exploitation chain, indicators of compromise and the controls that block the technique in production.
We write about what we see: ClickFix and fake CAPTCHA, device code phishing in Microsoft 365, Signal and WhatsApp account hijacking, hidden C2 over Teams, npm supply-chain attacks, KEV CVEs with observed exploitation. Each post answers: how are teams already dealing with it.
Microsoft has confirmed active exploitation of CVE-2026-42897, an XSS flaw in on-premises Exchange OWA that runs JavaScript the moment a crafted email is opened. What it means and how to contain it.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
The US is offering up to $10 million for information on Russian-linked groups that compromised Signal and WhatsApp accounts. What companies and executives should do next.
By Adrián González · CEO
On 23 June 2026 CISA added four UniFi OS and Lantronix EDS5000 flaws to its KEV catalogue. Chained, three of them give unauthenticated remote code execution on the box that manages your network.
By Adrián González · CEO
An unauthenticated endpoint in Splunk Enterprise's PostgreSQL service allows remote code execution. CISA added it to the KEV catalogue on 18 June. What breaks and how to contain it.
By Adrián González · CEO
DragonForce hid its command and control inside Microsoft Teams TURN relays and stayed undetected for nearly two months. How Backdoor.Turn works and how to hunt it on your network.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
On 17 June 2026 an attacker pushed more than 140 @mastra npm packages carrying a malicious dependency that runs a trojan during postinstall. What happened, and how to defend against it.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
We ran a 100% passive OSINT scan against 24 well-known brands and found 591 live typosquatting domains. 48% can send email. Anonymised aggregate data, June 2026.
By Adrián González · CEO
ClickFix tricks users into running PowerShell by pasting a command. 517% growth in 2025. Anatomy, operational detection and defences that genuinely work.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
SPIFFE/SPIRE for workload identity and OAuth for machine-to-machine: how each works, where each fits, and the hybrid pattern that scales for cloud-native enterprises.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
Technical playbook for SOC and IR teams: how to detect, contain and reduce Active Directory abuse in hybrid environments — Kerberoasting, AD CS misconfigurations, Golden Ticket and Entra ID.
By Thilina Manana · COO y Director Técnico de Seguridad hard2bit
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
