05 Sept 2026·9 min read

FalconFlank: privilege escalation through CrowdStrike Falcon's macro remediation

A published PoC turns Falcon's SYSTEM-level macro cleanup into an arbitrary write via a junction and an oplock race, dropping a DLL into System32. Root cause, mechanism and detection.

• Vulnerability Analysis
• Privilege Escalation
• EDR
• CrowdStrike
• TOCTOU

04 Sept 2026·12 min read

SmartLoader: Lua-based malware delivered through cloned GitHub repositories

Stage-by-stage analysis of a SmartLoader campaign: cloned GitHub repos, a renamed LuaJIT runtime, EtherHiding C2 on Polygon, and a stealer that bypasses Chrome App-Bound Encryption.

• Malware Analysis
• SmartLoader
• GitHub
• EtherHiding
• Infostealer