Blake White
ClickFix to DeerStealer: Reversing a Trojanized GitHub Desktop
From a fake Claude CAPTCHA to the DeerStealer payload — and a date-seeded DGA, reverse-engineered to enumerate every C2 domain the campaign will ever use.
ClickChain
Hunts EtherHiding-backed ClickFix campaigns: decodes the lure JavaScript, resolves smart-contract C2 and traces the operator's wallet.
Why You Can't Get a Cybersecurity Job
Cybersecurity isn't the easy career it's sold as. The hard truths I wish I'd heard when I was breaking in.
How Malware Survives Reboots
Finding malware hidden in scheduled tasks with PowerShell.
Linux Zero-Day CVE-2026-31431 Explained
"Copy Fail": a 9-year-old Linux kernel bug that lets any local user become root.
Claude Mythos & the Media Narrative
I read the system card and red-team write-up to debunk the four biggest claims in the coverage.
How to Build an AI SOC Analyst
An AI agent built with n8n, MCP and Gemini that checks links in VirusTotal and closes alerts in my SIEM.
$82K Gemini Vulnerability: 6,000 Exposed Google Keys
Gemini turned "safe" public Google API keys into a liability. I scanned the internet and found 6,000+ exposed.
SourceCrawler
Searches public code, GitHub and urlscan for exposed source. Built for my Gemini API key research.
SOC Burnout Myths & Career Growth
They said I'd be out of the SOC in 10 months. Two years in, how I avoided burnout.
ThreatHunter
PowerShell DFIR module: hunts persistence, event logs and browser artifacts, with ATT&CK mapping and HTML reports.
EntraScout
Detects and triages compromised Entra and Microsoft 365 accounts through automated log analysis.
ClickFix Fake CAPTCHA
Proof of concept of the ClickFix fake-CAPTCHA lure on Cloudflare, with Turnstile and IP fencing.
ExchangeResponder
Business email compromise response for Microsoft 365: purge mail tenant-wide and hunt malicious inbox rules.
Malware Deep Dive: DCRat
A fake "missed voicemail" leads to Dark Crystal RAT. The full chain, from infrastructure to in-memory payload.
WiFiReaper
Automated Wi-Fi deauthentication at scale: finds networks, deauths clients and captures WPA/WPA2 handshakes.
Black Hat & DEF CON 2025
A short recap of my first time at both conferences.
NetLocker
Watches your public IP and cuts network access when you're off VPN or on an unapproved connection.
BadSuccessor Scanner
Finds who can abuse dMSAs in Active Directory (BadSuccessor) to impersonate any account.
Vidar Infostealer Delivered by .MP4
Static and dynamic analysis of an active Vidar campaign, through the full infection chain.
AutorunHunter
Flags unsigned and suspicious autoruns with Sysinternals Autoruns to surface malware persistence.
ScreenConnect C2 URL Scanner
Extracts C2 URLs hidden in ScreenConnect binaries through certificate stuffing.
PersistenceHunter
Finds malware persistence in the registry, scheduled tasks, startup folders and services.
Tripwire
Detects and snapshots the files malware drops during dynamic analysis, including fileless loaders.
5 Habits That Transformed My Cybersecurity Career
Five habits from the past year that helped my career grow.
How North Korea Stole $1.5 Billion in Crypto
The Lazarus Group attack chain behind the largest crypto theft in history.
Phishing, Evilginx, AiTM MFA Bypass & BEC
How attackers build phishing infrastructure and bypass MFA, walked through end to end.
3 Projects That Got Me Hired in Cybersecurity
The technical projects behind my first SOC analyst job, and why they mattered.
Reflections on 1 Year as a SOC Analyst
Expectations versus reality, what I learned, and what worked.
Fake CAPTCHA Delivers LummaStealer
How a fake CAPTCHA campaign gets from initial access to an installed infostealer.
10 Security Tools I Use Every Day
The tools I genuinely can't live without, a few of them surprising.
Decrypting a Conference Badge's Secret Message
My first conference, BSides Bloomington 2024, and cracking its badge CTF.
Do You Need to Code in Cybersecurity?
The stereotype versus reality, and my honest answer.
My Regrets and Advice on Cybersecurity Degrees
What I'd do differently to get more out of the degree.
How to Hack a Web Server (CTF)
A TryHackMe walkthrough: enumeration, a CVE exploit and Linux privilege escalation to root.
The Resume That Got Me into Cybersecurity
The resume behind my first cybersecurity role, with a free template.
Building a Honeypot to Catch Hackers
Three weeks of a honeypot on the open internet, thousands of attacks, and the investigation.
Block Ads, Trackers and Malware with Pi-hole
A $20 Raspberry Pi as a network-wide DNS sinkhole, six months in.
How I Got a Cybersecurity Job With No Experience
From college graduate to SOC analyst in a tough entry-level market.
The Ransomware Gang That Hacked Sony
Who hit Insomniac Games, how it may have happened, and what leaked.
BetterHelp Lied to You (for Money)
How BetterHelp shared private mental-health data with advertisers, and the $7.8M fine.
Remote Keylogger
A Python keylogger disguised as a JPEG, documented step by step.
Network Intrusion & Sniffing
Network intrusion, password cracking and packet sniffing on a home network.
SOC & SIEM Home Lab
Attack and defense lab: Sliver C2 against LimaCharlie, simulating and detecting attacks.
SOC Training
TryHackMe's SOC Level 1 path, documented.
Web Application Development
A team-built web app, developed with the SCRUM framework.
© 2026 Blake White