The Deep Purple Sec – June 2025
A monthly round-up of interesting articles, reports and tools for tech experts, covering both offensive and defensive topics.
🔴 Red Team
📝 FileFix – An alternative to ClickFix
The article discusses FileFix, a social engineering technique using HTML <‘input type= »file »‘> elements to launch File Explorer and execute OS commands. It tricks users into executing a malicious command by copying it to the clipboard when they are prompted to open a file dialogue. A proof-of-concept demonstrates how JavaScript can block file selection and ensure the payload executes when the Enter key is pressed. A variant may bypass SmartScreen protections. The author advises monitoring child processes such as cmd.exe, powershell.exe, or mshta.exe during file uploads to detect misuse of FileFix.
📌 Source: https://mrd0x.com/filefix-clickfix-alternative/
📝 Unmasking the Infrastructure of a Spearphishing Campaign
The article provides a detailed analysis of a spearphishing campaign that uses obfuscated Visual Basic Script (VBS) files named «sostener.vbs». «. This robust three-stage malware system deploys Remote Access Trojans (RATs) such as Remcos and AsyncRAT, utilising dynamic DNS services such as »duckdns.org’ for command-and-control. It is clearly linked to the Colombian threat actor APT-C-36. The article provides a detailed overview of the stages of malware deployment, the hosting services used and the specific domains involved, concluding with definitive indicators of compromise (IOCs) to enable effective threat detection and mitigation.
📌 Source: https://censys.com/blog/unmasking-the-infrastructure-of-a-spearphishing-campaign
📝 Dragging Secrets Out of Chrome: NTLM Hash Leaks via File URLs
The article confidently addresses a vulnerability in Chromium-based browsers that leaks NTLM hashes via file URLs. It clearly demonstrates how a social engineering attack can exploit the drag-and-drop feature to capture NTLM hashes by deceiving users. The author thoroughly explains how to set up a malicious webpage and how to use tools such as Responder to capture hashes, outlining the conditions required for a successful attack and providing a compelling demonstration via an online tool and a GitHub repository.
📌 Source: https://trustedsec.com/blog/dragging-secrets-out-of-chrome-ntlm-hash-leaks-via-file-urls
🔵 Blue Team
📝 Detection Pitfalls You Might Be Overlooking
The article discusses five flaws in detection engineering that allow attackers to bypass robust rules. It shows how minor variations, such as alternative flag prefixes (-EncodedCommand, /e, etc.), can evade string-based detection, and how command chaining and redirection (|, &) can fragment logs, thereby bypassing correlation rules. It also covers edge cases such as double spaces and obfuscation techniques that undermine pattern-based detection. Furthermore, it warns that unaudited CMD commands may not generate logs, creating blind spots. The author suggests using resilient, behaviour-oriented patterns—such as regular expressions and event correlation—to create robust detection rules.
📌 Source: https://detect.fyi/detection-pitfalls-you-might-be-sleeping-on-52b5a3d9a0c8
📝 The Cyber Deception Maturity Model: Where Does Your Organisation Stand?
This article presents a Cyber Deception Maturity Model that enables organisations to assess and enhance their deception capabilities across five maturity levels. It details developments in personnel, processes, technology and strategies, illustrating the evolution from basic honeypots to advanced techniques for detecting and understanding adversaries. The guidance on transitioning between levels emphasises the need for strategic planning and continuous improvement, establishing deception as a strategic advantage in security.
📌 Source: https://deceptiq.com/blog/cyber-deception-maturity-model
📝 Why is no one talking about maintenance in detection engineering?
The article emphasises the critical importance of maintenance in detection engineering, despite its perceived lack of glamour compared to new development. It discusses challenges such as false positives and deprecated tuning, categorising maintenance into corrective, adaptive, perfective and preventive types, with relevant examples. The author argues that maintenance should be viewed as a proactive process and calls for greater industry dialogue to improve the resilience of detection systems and reduce alert fatigue.
Never trust, always check