[~]$ whoami?
Security engineer and researcher. eBPF security, EDR internals, and threat intelligence. Breaking things at the kernel level and hunting threat actors across phishing infrastructure.
Selected work
When BPF Blinding Goes Dark
My Black Hat USA 2026 talk on smuggling raw gadgets past eBPF constant blinding.
Background: eBPF JIT constant blinding
CVE-2026-23417
The bug behind the talk, which I found and patched in the kernel.
Hunting 210K Phishing URLs
A China-based phishing kit going after 24 Indian banks, tracked down and taken offline.
CVE-2025-32324
A root-cause analysis of an Android ActivityManagerShellCommand auth bypass.
Recent
How Attackers Are Weaponizing OAuth to Silently Take Over Microsoft Outlook Accounts
OAuth phishing against Microsoft Outlook that takes the mailbox without stealing the password.
Novel approach to tackle UAF Bugs in the Linux Kernel
How dedicated bucket allocators limit use-after-free bugs in the Linux kernel.