# TechKey

> In-depth cybersecurity news, malware analysis, DFIR, threat intelligence and penetration testing resources for security professionals and researchers.


## Posts

- [PHP2Shell: How an AI Found Two Decade-Old Flaws That Shook Most of the Web](https://techkeynews.com/php2shell-how-an-ai-found-two-decade-old-flaws-that-shook-70-of-the-web/): Two critical, decade-old PHP vulnerabilities — found by an AI, not a human researcher — triggered emergency patches, government site shutdowns, and warnings from CISA, NCSC, and agencies worldwide. PHP runs an estimated 70-75% of the web, depending on the source.
- [The Fake IT Helpdesk Is Calling You on Teams — And It's Working](https://techkeynews.com/the-fake-it-helpdesk-is-calling-you-on-teams-and-its-working/): Multiple unrelated threat groups have converged on the same playbook this year: spam an inbox, follow up on Microsoft Teams pretending to be IT support, and talk the victim into installing the malware themselves.
- [GigaWiper: The Backdoor That Poses as Ransomware — Then Wipes Your Disk for Good](https://techkeynews.com/gigawiper-backdoor-disk-wiper-fake-ransomware/): Microsoft has detailed GigaWiper, a Go-based Windows backdoor that merges a raw disk wiper, fake ransomware built on Crucio code, and a secure multi-pass wiper into one modular implant — disguised as OneDrive.
- [Claude Code Proxy Detection: Separating Facts from Speculation](https://techkeynews.com/claude-code-china-proxy-detection-steganography/): Claude Code versions 2.1.193 through 2.1.196 used Unicode steganography to encode China proxy detection signals into system prompts — invisible to the eye, but distinct at the byte level. Here is a technical walkthrough of what was found, what it means, and what the response reveals about trust in AI developer tooling.
- [How Ransomware Encrypts Your Files: A Technical Deep Dive](https://techkeynews.com/how-ransomware-encrypts-your-files-a-technical-deep-dive/): Ransomware uses a hybrid AES-256 + RSA-4096 encryption scheme that's mathematically unbreakable without the attacker's master key. Here's exactly how it works, why decryptors sometimes exist, and what it means for defence.
- [ClickFix on macOS: How Hackers Trick You Into Infecting Your Own Mac](https://techkeynews.com/clickfix-on-macos-how-hackers-trick-you-into-infecting-your-own-mac/): ClickFix is the social engineering technique that bypasses Gatekeeper entirely by tricking macOS users into pasting malicious Terminal commands. Here’s how it works, what it steals, and how to stop it.
- [LOLBAS: How Hackers Use Windows' Own Tools Against You](https://techkeynews.com/lolbas-how-hackers-use-windows-own-tools-against-you/): Attackers don't always bring their own tools. certutil, mshta, regsvr32, wmic — Microsoft-signed binaries already on your machine can download payloads, run scripts, and establish persistence without triggering traditional AV.
- [Dissecting a Phishing Email: What the Headers Actually Tell You](https://techkeynews.com/dissecting-a-phishing-email-what-the-headers-actually-tell-you/): The From field in a phishing email is trivially spoofed. The real story is in the routing headers — the Received chain, SPF/DKIM/DMARC results, and Message-ID. Here's how to read them.
- [North Korea's Secret Army: How DPRK IT Workers Infiltrated 300+ US Companies](https://techkeynews.com/north-koreas-secret-army-how-dprk-it-workers-infiltrated-300-us-companies/): North Korean government operatives are posing as remote IT workers inside Western companies, funnelling salaries to fund weapons programs. With $800M+ generated in 2024 and 300+ US firms compromised, this is one of the most active nation-state threats of our time.
- [Windows Event Log IDs Every Blue Teamer Should Know](https://techkeynews.com/windows-event-log-ids-every-blue-teamer-should-know/): There are hundreds of Windows Event IDs but you really only need about 30 of them to catch most attacks. Here are the ones that matter, what they mean, and what attackers do to avoid them.
- [Google Dorks: How Hackers Use Search Engines to Find Vulnerable Websites](https://techkeynews.com/google-dorks-how-hackers-use-search-engines-to-find-vulnerable-websites/): Before an attacker writes a single line of exploit code, they've already mapped your attack surface using nothing but Google. Here's how Google Dorking works and how to find out what you've exposed.
- [Unveiling the Snake Infostealer: How It Spreads Through Facebook Messenger](https://techkeynews.com/snake-infostealer-facebook-messenger/): In early 2024, researchers at Cybereason uncovered a new threat targeting Facebook users — a Python-based information stealer dubbed Snake (not to be confused with the Russian state-sponsored Snake rootkit).
- [Server Message Block (SMB) 101: The Protocol That Keeps Getting Abused](https://techkeynews.com/server-message-block-smb-101/): SMB — Server Message Block — is one of those protocols that most Windows users have never heard of, but that underpins a huge amount of what happens on corporate networks every day.
- [Domain Name System (DNS) Logs 101: The Defender's Underrated Data Source](https://techkeynews.com/domain-name-system-dns-logs-101/): If you ask most security analysts what their most valuable data source is, they’ll say endpoint logs or firewall logs. DNS logs rarely make the top of the list.
- [PIKABOT: The Malware That Stepped Into QakBot's Shoes](https://techkeynews.com/pikabot-malware-emerging-cybersecurity-threat/): When law enforcement took down QakBot in August 2023, many in the security community wondered what would fill the void.
- [What Is MCP (Model Context Protocol) and Why the AI World Is Talking About It](https://techkeynews.com/what-is-model-context-protocol-mcp/): If you’ve been paying attention to the AI tooling space recently, you’ve probably come across the term MCP.
- [Delving Into the Mark of the Web: Windows' Hidden Security Boundary](https://techkeynews.com/mark-of-the-web-windows-security/): There’s a little-known security feature built into Windows that quietly influences whether a file you download can run macros, execute scripts, or open without warnings.
- [Exploring RDP Logs: What They Tell You and Why You Should Care](https://techkeynews.com/exploring-rdp-logs-threat-detection/): Remote Desktop Protocol (RDP) is one of the most widely used — and most abused — features in Windows environments.
- [BIMI Explained: How Brand Logos in Email Are Changing the Trust Game](https://techkeynews.com/bimi-explained-brand-logos-email-trust/): You’ve probably noticed that some emails in your inbox now show a company logo right next to the sender’s name.

## Pages

- [VibeRoom](https://techkeynews.com/tools/viberoom/)
- [Subhash Thapa](https://techkeynews.com/subhash-thapa/)
- [Categories](https://techkeynews.com/categories/): Browse everything on TechKey by topic — DFIR, malware analysis, threat intel, and more.
- [Phishing Simulation](https://techkeynews.com/services/phishing-simulation/): Realistic, safe phishing campaigns to test, measure, and improve your organisation's human firewall — with detailed reporting and follow-up training.
- [IOCLens](https://techkeynews.com/tools/ioclens/): Extract and classify Indicators of Compromise from a URL, pasted text, or an uploaded file — IPs, domains, hashes, CVEs, emails, YARA rules, and more.
- [Resources & Tools](https://techkeynews.com/tools/): Free, lightweight security tools for analysts and researchers — IOCLens, DomainLens, and OSINT Toolkit.
- [Career](https://techkeynews.com/career/): We're a growing cybersecurity media platform and we're always looking for talented, passionate people to contribute.
- [Weekly Subscription](https://techkeynews.com/weekly-subscription/): Cybersecurity intelligence, delivered to your inbox.
- [Services](https://techkeynews.com/services/): Practical security services for teams that need real results — Phishing Simulation and Free Mentorship.
- [Privacy Policy](https://techkeynews.com/privacy-policy-2/): TechKey News ("we", "our", or "us") is committed to protecting your privacy.
- [About Us](https://techkeynews.com/about-us/): Your trusted source for cybersecurity intelligence, research, and analysis.
- [Contact Us](https://techkeynews.com/contact/): Have a tip, collaboration idea, or question? We'd love to hear from you.

## Optional

- [Agent (MCP protocol)](websites-agents.hostinger.com/techkeynews.com/mcp)

[comment]: # (Generated by Hostinger Tools Plugin)