ThinkstScapes Research Roundup - Q3 - 2025

Q3’25 ThinkstScapes Microsoft-induced security woes One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens Dirk-jan Mollema [Blog post] Turning Microsoft's Login Page into our Phishing Infrastructure Keanu Nys [Slides] [Video] You snooze you lose: RPC-Racer winning RPC endpoints against services Ron Ben Yizhak [Slides] [Code] [Video] Internal Domain Name Collision 2.0 Philippe Caturegli [Slides] [Video] Logs are not always as they appear Source IP Spoofing in Cloud Logs: A Hands-On Look Across AWS, Azure, and GCP Eliav Livneh [Video] I'm in Your Logs Now, Deceiving Your Analysts and Blinding Your EDR Olaf Hartong [Slides] [Code] From Spoofing to Tunneling: New Red Team's Networking Techniques for Initial Access and Evasion Shu-Hao Tung [Slides] [Paper] [Video] Autobots roll out! Automating software security with LLMs Tyler Nighswander [Site] [Code] [Video] Agents Built From Alloys Albert Ziegler [Blog post] [Dataset] AI Agents for Offsec with Zero False Positives Brendan Dolan-Gavitt [Slides] Are CAPTCHAs Still Bot-hard? Generalized Visual CAPTCHA Solving with Agentic Vision Language Model Xiwen Teoh, Yun Lin, Siqi Li, Ruofan Liu, Avi Sollomoni, Yaniv Harel, and Jin Song Dong [Site] [Paper] [Code] Good vibrations Invisible Ears at Your Fingertips: Acoustic Eavesdropping via Mouse Sensors Mohamad Habib Fakih, Rahul Dharmaji, Youssef Mahmoud, Halima Bouzidi, and Mohammad Abdullah Al Faruque [Site] [Paper] TimeTravel: Real-time Timing Drift Attack on System Time Using Acoustic Waves Jianshuo Liu, Hong Li, Haining Wang, Mengjie Sun, Hui Wen, Jinfa Wang, and Limin Sun [Paper] Nifty sundries Crescent library brings privacy to digital identity systems Christian Paquin, Guru-Vamsi Policharla, and Greg Zaverucha [Blog post] [Paper] [Code] Journey to the center of the PSTN: How I became a phone company, and how you can too Enzo Damato [Slides] [Video] Safe Harbor or Hostile Waters: Unveiling the Hidden Perils of the TorchScript Engine in PyTorch Ji'an Zhou and Lishuo Song [Slides] Ghosts in the Machine Check – Conjuring Hardware Failures for Cross-ring Privilege Escalation Christopher Domas [Slides] [Code] [Video] Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents Avital Shafran, Roei Schuster, and Vitaly Shmatikov [Paper] [Code] Inverting the Xorshift128+ random number generator Scott Contini [Blog post] [Code]