Security Research & Insights

Prevention Lab Weekly

Deep dives into threat intelligence, application control strategies, and the latest research on living-off-the-land attacks from our security team.

Expert ResearchUpdated WeeklyFree & Open Access

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

The same techniques that dominated breach reports in 2019 are still topping the charts in 2026 and most of them are blockable today. Three major threat reports, one conclusion: we keep detecting what we could be preventing. A response to the "detection is mandatory" crowd - with receipts.

Jose Hernandez

Threat Researcher

Read article

Illustration showing a Windows executable connected through a trust chain to an Apple iOS distribution certificate, highlighting abuse of trusted signing and policy mismatch.

February 17, 202611 min

Apple iOS Distribution Certificate Used to Sign Windows Malware

Illustration of a legitimate Windows kernel driver with a valid digital signature being weaponized to disable endpoint security, representing BYOVD attacks where signed drivers are abused to bypass Microsoft EDR protections

January 21, 20269 min

TrueSightKiller: 2,500+ Weaponized Security Tool Variants Bypassing Microsoft's Defenses

Sort:

Topics:

All Articles

We Stopped Choosing LLMs by Vibe. Here's the Eval Harness We Built Instead

Releases & Updates

May 5, 20269 min read

We Stopped Choosing LLMs by Vibe. Here's the Eval Harness We Built Instead

Picking an AI model by feel isn't a strategy, it's a gut check. MagicSword built an open-source evaluation harness to compare models on what actually matters: accuracy, cost, and speed against real workflows. Here's why the process matters more than any leaderboard.

Jose Hernandez

Cinematic close-up of a cursor hovering over a glowing link in a dark email interface, the screen casting cold blue light onto the keyboard below, in the background a faint hooded figure reflected in the monitor glass, neon red connection lines beginning to branch outward from the screen into the darkness

Threat Research & Intelligence

April 27, 20267 min read

One Click, Full Access: How MagicSword Prevents Malicious ScreenConnect Installs

A real phishing email. A real ScreenConnect installer. No malware, no exotic exploit, just a signed, legitimate file that hands an attacker a persistent shell on your endpoint. Here's exactly how the attack works, and how MagicSword stops it before the installer ever runs.

Prevention Lab Weekly

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

Apple iOS Distribution Certificate Used to Sign Windows Malware

TrueSightKiller: 2,500+ Weaponized Security Tool Variants Bypassing Microsoft's Defenses

We Stopped Choosing LLMs by Vibe. Here's the Eval Harness We Built Instead

One Click, Full Access: How MagicSword Prevents Malicious ScreenConnect Installs

LOLExfil and ExtSentry Intelligence: MagicSword Now Blocks Exfiltration Tools & Malicious Extensions

RMM Abuse Jumped 277% in a Year. Two Blogs This Week Show Why

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

The Guard and the Thief Carpool

R$1.5 Billion in 12 Months: What the Pix Settlement Attacks Reveal About Where Security Fails

Microsoft Is Killing Cross-Signed Drivers. So Malicious Drivers Are Done... Right?

The Eternal Cybersecurity Pendulum: Why Prevention Is Back

Stop Detecting. Start Preventing. The Case for Mean Time to Prevent (MTTP)

AI Makes Getting In Easy. What Happens Next Is the Real Problem

What is LOLDrivers? The Project That Brought Malicious Drivers Into the Light

Apple iOS Distribution Certificate Used to Sign Windows Malware

What is LOLRMM? The Community-Driven Project Exposing Remote Monitoring Tool Abuse

CISA Called It: Stop RMM Tool Abuse Before Attackers Do

Blocking ClickFix with Intelligence-Driven Application Control

Announcing Cert Graveyard Intelligence in MagicSword

A Quiet Contribution, Long Before the Noise: Northwave and LOLDrivers

TrueSightKiller: 2,500+ Weaponized Security Tool Variants Bypassing Microsoft's Defenses

Allowlisting vs. Blocking Abuse: Two Paths to Application Control

MagicSword Portal - Feature Release Summary

Browser Extension Visibility: Why Inventory Changes the Game

POORTRY Still Active in 2026: The Microsoft Signing Crisis That Won't Go Away

Ghost Certificates: How Decade-Old Code Signing Infrastructure Enables Modern Malware

The $100M Freight Heist That EDR Never Saw Coming

HeartCrypt: The Packer Service That's Helping Ransomware Groups Kill Your EDR

The Great AppLocker Migration

How Scattered Spider Weaponizes "Legitimate" Tools And How to Stop Them

The M&S Breach: A Wake-Up Call for Teams Still Chasing Malware

Announcing LOLRMM: A Unified Approach to RMM Software Tracking

LOLDrivers and HVCI

Streamlining LOLDrivers Contributions Via Streamlit

A Behind-the-Scenes Look at Creating LOLDrivers

Introducing sigconverter.io: The Community-Driven Sigma Translation Tool

Unmasking Malicious Bootloaders with Bootloaders.io

LOLDrivers 2.0: Pioneering Progress

Living Off The Land Drivers 1.0 Release: New Features, Enrichments, and Community Contributions

Living Off The Land Drivers