Research Notes
Weekly notes on threat intelligence, LLM security, red teaming, and AI. Published every Sunday. Raw and unfiltered, this is my working log.
SoK Mirror Review, C2PA 2.1 Migration, and Threat Landscape Velocity
Weekly research and development update covering credential-harvesting attack evolution, C2PA 2.1 spec integration for ProvStamp, ThreatWatch deduplication improvements using MinHash LSH, PhishRig template updates, and emerging threat activity from ClearFake, StrelaStealer, and BEAST ransomware.
LLM Phishing A/B Results, Moxel Follow-up, and ThreatWatch Feed Health
The phishing A/B test results are in. LLM-generated templates matched human-crafted ones on click rate and beat them on credential entry. Also: Moxel prefetch numbers and ThreatWatch freshness scoring live.
Moxel 4-GPU Benchmarks and Setting Up the LLM Phishing A/B Test
Proper Moxel benchmarks with prefetching enabled across 4x RTX 3090s. Also the experimental setup for comparing LLM-generated vs human-crafted phishing templates in PhishRig.
EU AI Act Article 50 in Practice: What ProvStamp Needs to Actually Deliver
Five months to August 2, 2026. Getting concrete about what Article 50 requires technically and what ProvStamp needs to be to serve as a compliance layer.
ThreatWatch Feed Audit and the BEC Landscape in Early 2026
Finally did the ThreatWatch feed audit I've been putting off. 18% of sources were returning stale data. Also notes on TA4903 and how BEC actors are adapting their delivery methods.
Indirect Prompt Injection and the RAG Attack Surface
The Greshake paper on indirect prompt injection is from 2023 but it's more relevant now than when it was published. RAG is everywhere and the attack surface is real.
Moxel: Why VRAM Pooling Across Consumer GPUs Is Hard and How We're Approaching It
First real week on Moxel. PCIe bandwidth is the constraint everyone hits. Notes on the architecture approach and where the overhead actually comes from.
Evilginx3, AiTM, and Why MFA Isn't the Last Line of Defence
Set up Evilginx3 this week as part of the PhishRig build. Working through adversary-in-the-middle mechanics properly, it's a cleaner attack than most people realise.
QR Code Phishing: How Quishing Works and Why It's Getting Past Email Filters
Quishing volumes are up and the evasion techniques have matured significantly. Breaking down the mechanics and what this means for PhishRig's simulation capability.
Reading the C2PA Spec: What It Actually Does and Where the Gaps Are
Spent the week in the C2PA v2.2 specification for ProvStamp. Here's what content credentials actually are, what they don't cover, and the design decisions I'm landing on.