<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Blake White · Research</title><description>Security research and attack breakdowns by Blake White.</description><link>https://blakekwhite.com/research/</link><language>en</language><atom:link href="https://blakekwhite.com/rss.xml" rel="self" type="application/rss+xml"/><item><title>ClickFix to DeerStealer: Reversing a Trojanized GitHub Desktop</title><link>https://blakekwhite.com/research/clickfix-github-desktop-backdoor/</link><guid isPermaLink="true">https://blakekwhite.com/research/clickfix-github-desktop-backdoor/</guid><description>From a fake Claude CAPTCHA to the DeerStealer payload — and a date-seeded DGA, reverse-engineered to enumerate every C2 domain the campaign will ever use.</description><pubDate>Mon, 05 Oct 2026 00:00:00 GMT</pubDate><category>Malware analysis</category></item></channel></rss>