A multi-part series on Microsoft's ClickOnce deployment technology — why it's still a viable initial access primitive in 2026, how attackers hijack existing trusted ClickOnce apps via unsigned dependencies, and the detection rules that actually catch it.
Projects & ongoing research
A running log of what I'm working on, what's done, and what's planned next.
Network Security Providers & NPPSpy
PublishedExperiments with Windows Security Support Providers — looking at NPPSpy-style credential capture techniques, how the Network Provider API still works on modern Windows, and what detection signal it leaves behind.