ThinkstScapes Research Roundup - Q3 - 2025

Q3’25 ThinkstScapes Microsoft-induced security woes One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens

Dirk-jan Mollema

[Blog post]

Turning Microsoft's Login Page into our Phishing Infrastructure

Keanu Nys

[Slides] [Video]

You snooze you lose: RPC-Racer winning RPC endpoints against services

Ron Ben Yizhak

[Slides] [Code] [Video]

Internal Domain Name Collision 2.0

Philippe Caturegli

[Slides] [Video]

Logs are not always as they appear Source IP Spoofing in Cloud Logs: A Hands-On Look Across AWS, Azure, and GCP

Eliav Livneh

[Video]

I'm in Your Logs Now, Deceiving Your Analysts and Blinding Your EDR

Olaf Hartong

[Slides] [Code]

From Spoofing to Tunneling: New Red Team's Networking Techniques for Initial Access and Evasion

Shu-Hao Tung

[Slides] [Paper] [Video]

Autobots roll out! Automating software security with LLMs

Tyler Nighswander

[Site] [Code] [Video]

Agents Built From Alloys

Albert Ziegler

[Blog post] [Dataset]

AI Agents for Offsec with Zero False Positives

Brendan Dolan-Gavitt

[Slides]

Are CAPTCHAs Still Bot-hard? Generalized Visual CAPTCHA Solving with Agentic Vision Language Model

Xiwen Teoh, Yun Lin, Siqi Li, Ruofan Liu, Avi Sollomoni, Yaniv Harel, and Jin Song Dong

[Site] [Paper] [Code]

Good vibrations Invisible Ears at Your Fingertips: Acoustic Eavesdropping via Mouse Sensors

Mohamad Habib Fakih, Rahul Dharmaji, Youssef Mahmoud, Halima Bouzidi, and Mohammad Abdullah Al Faruque

[Site] [Paper]

TimeTravel: Real-time Timing Drift Attack on System Time Using Acoustic Waves

Jianshuo Liu, Hong Li, Haining Wang, Mengjie Sun, Hui Wen, Jinfa Wang, and Limin Sun

[Paper]

Nifty sundries Crescent library brings privacy to digital identity systems

Christian Paquin, Guru-Vamsi Policharla, and Greg Zaverucha

[Blog post] [Paper] [Code]

Journey to the center of the PSTN: How I became a phone company, and how you can too

Enzo Damato

[Slides] [Video]

Safe Harbor or Hostile Waters: Unveiling the Hidden Perils of the TorchScript Engine in PyTorch

Ji'an Zhou and Lishuo Song

[Slides]

Ghosts in the Machine Check – Conjuring Hardware Failures for Cross-ring Privilege Escalation

Christopher Domas

[Slides] [Code] [Video]

Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents

Avital Shafran, Roei Schuster, and Vitaly Shmatikov

[Paper] [Code]

Inverting the Xorshift128+ random number generator

Scott Contini

[Blog post] [Code]