Threat Intelligence & Security Research

Threat Intelligence // Research Dispatches

Security Field Research & Technical Advisories.

Field reports, vulnerability post-mortems, botnet telemetry, and architectural defense playbooks produced by ThreatPoint’s engineering and adversary simulation teams.

Threat Investigation Published: 14 Oct 2026 • 7 min read

Anatomy of Residential Proxy Farms in Automated Credential Stuffing

Modern account takeover attacks no longer originate from obvious hosting providers. We dissect how adversarial agentic scripts lease rotating residential endpoints, evade static IP rate limits, and how intent-based signal analysis flags them before execution.

Read Full Investigation

EDGE_INGRESS // HONEYPOT_PROBE CONFIRMED_ROTATOR

"origin_ip": "185.220.101.4",
"proxy_class": "RESIDENTIAL_FLEET",
"fingerprint_entropy": 0.942,
"mitigation": "CHALLENGE_AT_EDGE",
"latency_penalty": "1.4ms"

Cloud Security 02 Oct 2026

Serverless IAM Privilege Escalation: Guarding AWS Lambda & API Gateway

Over-permissive microservices are the fastest route to lateral movement. Practical IAM boundary rules and AWS Lambda execution role hardening to prevent unauthorized STS token assumption.

ThreatPoint Cloud Advisory Read

Human Layer 24 Sep 2026

The Rise of Generative AI Phishing: Deceptive Typosquatting in UK Legal Firms

Analysis of real-world invoice redirection campaigns targeting corporate accounts departments, exploiting late Friday settlement deadlines without triggering traditional email grammar filters.

Phishing Research Team Read

Advisory 11 Sep 2026

Sub-2ms Edge Evaluation: Differentiating Search Crawlers from Malicious Scrapers

How our intent detection engine verifies reverse DNS pointer records (FCrDNS), inspects TLS client hello fingerprints, and drops scrapers without interrupting legitimate SEO indexing.

Active Defense Lab Read

Governance 18 Aug 2026

Aligning Serverless Pipelines with ISO/IEC 27001 & NIST CSF 2.0

Transforming theoretical compliance checklists into verifiable CI/CD automated gates. A playbook for engineering teams preparing for strict enterprise supplier audits.

vCISO Practice Read

Device Biometrics 04 Aug 2026

Defeating Headless Browser Spoofing: WebGL Shaders & Audio Buffer Entropy

A technical breakdown of how Puppeteer and Playwright camouflage navigator flags, and how measuring offline WebGL unmasked renderers and audio dynamic compressor outputs exposes them.

Biometrics Engineering Read

Penetration Testing 21 Jul 2026

Simulating Adverse Edge Attacks: Beyond Generic Web Application Scans

Why out-of-the-box vulnerability scanners miss business logic vulnerabilities in bespoke APIs, and how targeted adversary simulation identifies state-machine manipulation before launch.

Offensive Security Unit Read