An Approach to Bypassing Mail Filters

NetSPI demonstrates obfuscating HTML smuggling with Web Assembly, embedding payloads in Wasm so files reassemble victim-side and evade network detections that flag suspicious outbound file downloads.

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

Traces the evolution of offensive PowerShell invocation from powershell.exe command lines to in-memory .NET loading with UnmanagedPowerShell, evading process creation monitoring.

BOFScale runs a patched Tailscale daemon as a BOF-PE inside the implant, relaying C2 over standard WebSockets so DERP and control-plane traffic blends in behind CDNs like CloudFront and Fastly.

Will Pearce demonstrates machine learning for red teams: a simple process list provides enough data to detect sandbox environments, helping payloads avoid detonation and extend technique lifespan.

Alexander Leary updates RunDotNetDll32 to load .NET assemblies via Type.GetType instead of suspicious Assembly.LoadFile calls, executing DLL methods while dodging common detection logic.