Detections, written like prose.
Field notes on detection engineering, machine learning, and the craft of finding what hides in the noise — plus short fiction away from the terminal.
How invisible Unicode tags hide adversarial instructions in email aimed at AI scanners and tools.
Research into malicious calendar invitations sent through legitimate service providers.
How attackers embed callback lures in automated notifications from trusted services.
In email attacks, adversaries most often use prompt injection to confuse AI security analysis (for now).
AI signals within email attacks can bolster detection, prevention, and threat hunting.
A cautionary tale of how I'm detecting and hunting for LLM generated emails, and some tools for you to do the same.
Credential phishing with fake and hijacked Meta for Business programs.
Short fiction is in progress — stories away from the terminal. Check back soon.
Detections, written like prose.
Field notes on detection engineering, machine learning, and the craft of finding what hides in the noise. Most pieces are published on the Sublime Security blog.
How invisible Unicode tags hide adversarial instructions in email aimed at AI scanners and tools.
Research into malicious calendar invitations sent through legitimate service providers.
How attackers embed callback lures in automated notifications from trusted services.
In email attacks, adversaries most often use prompt injection to confuse AI security analysis (for now).
AI signals within email attacks can bolster detection, prevention, and threat hunting.
A cautionary tale of how I'm detecting and hunting for LLM generated emails, and some tools for you to do the same.
Credential phishing with fake and hijacked Meta for Business programs.
MEDIA & INTERVIEWS
The rise of calendar phishing
A conversation with Catalin Cimpanu about calendar-based phishing campaigns.
Invisible prompts and inbox AI agents
Discussing hidden Unicode instructions in invoice scams targeting AI agents.
Calendar phishing explained
Commentary on calendar scams.
Remember Postini?
Discussing callback phishing hidden in automated notifications, alerts, and receipts.