ITSEC Newsletter 2026-06-25

Author

Henrik Falk
June 25, 2026

LACUNA Chain: Ghost Frames - defeats all EDR layers of call-stack-based detection

Part I showed how to defeat userland NTDLL hooks with IAT manipulation, dynamic SSN resolution, and indirect syscalls. That was the state of the art in 2024. Then EDR vendors read our research. They adapted. They stopped relying on userland hooks and moved their primary telemetry into the kernel — where our Part I tricks can’t reach. They started collecting call stacks at the kernel boundary, and suddenly it didn’t matter that you bypassed ntdll. Your shellcode address was sitting right there in the collected stack. So I went deeper. This paper is about making that collected call stack lie.

Mohamed Alzhrani

Exploiting Auth0 Defaults in XSS Attacks

We identified two noteworthy default configurations within Auth0 that may be exploited to pivot across applications within an Auth0 tenant from a single XSS vulnerability. This article highlights that the insecure implicit grant flow is enabled by default in Auth0 Applications and demonstrates how it can be chained with other Auth0 misconfigurations to laterally move to other systems.

www.elttam.com/blog/exploiting-auth0-defaults-in-xss-attacks

Fantastic clear-text passwords and where to collect them (Part 1 - Linux)

This post highlights common techniques and artifacts encountered in real-world incidents, mapping out exactly where plaintext credentials leak and how adversaries systematically collect them. In addition, it covers hardened Linux appliances and discusses how credentials may still be exposed despite security controls.

dfir.ch