Alfie Champion
@ajpc500
Followers
3K
Following
4K
Media
83
Statuses
701
Founder at @delivr_to | Author of Practical Purple Teaming | Detection & Emulation at @github | Tweets my own
London, England
Joined November 2010
With a process that began two and a half years ago, I'm very excited to announce that I've written a book with @nostarch! 🎉 "Practical Purple Teaming" tells you all you need to know to get started with collaborative offensive testing. https://t.co/2syCI1JmDd
nostarch.com
Real-world threats demand real-world teamwork.
9
59
284
Phorion Threat Report: a backdoored Cursor extension was used to deploy the Paradox Stealer infostealer into macOS developer workflows. The post breaks down the full infection chain, detection opportunities and why IDE extensions have become a reliable point of initial access.
18
13
46
I wrote a thing about some recent dabbling with AppleScripts
0x626c6f67.xyz
Following a recent blog post covering the increasingly common use of compiled AppleScripts in malware, I wanted to explore methods to further hide malicious scripts and reduce the chance of detecti...
1
6
41
I got a sneak preview of this research and it’s a must-see for anyone attacking or defending macOS environments! 🍎🍪
Our very own @_calumhall will be speaking at KawaiiCon (prev. KiwiCon!) today talking about Phorion's innovation in ransomware defence and recovery. Where he will be discussing the technical inner workings and some cool tricks to build a comprehensive anti-ransomware solution.
0
0
2
Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more ⤵️
specterops.io
Uncovering the protection mechanisms provided by modern Windows security features and identifying new methods for credential dumping.
4
307
657
Finally disclosing the critical supply chain attack I've spent the last 6 months preventing: 🧵
2
12
48
I just finished reading my signed early edition of Practical Purple Teaming: The Art of Collaborative Defense by @ajpc500 (Alfie Champion), and it was an excellent read. The book serves as a complete survey of the tactics, tools, and procedures involved in purple teaming. It
8
49
369
💜💜💜
Review: Practical Purple Teaming - https://t.co/jalPEZjqlS - @nostarch #Cybersecurity #PurpleTeam #RedTeam #BlueTeam #Infosec
0
0
1
🚀 Super excited to finally share that I have been working on a startup for over a year: @offensys! Offensys provides an enterprise platform for automated advanced attack simulations to enable continuous posture validation. 🌐Check out our new website: https://t.co/h00eOYbJx5
16
19
121
If you haven’t already, check out @Print3M_’s research on File System APIs here: https://t.co/DFFcVPTD2s We went down the exfil path for this research, but certainly some abuse potential there!
print3m.github.io
FileJacking – Malware Initial Access technique with File System API. Backdoor files, read / write folders directly from the browser – no downloads.
An infostealer that runs in the browser? Kinda. In our latest research, we explore how Chromium File System APIs can be abused to exfiltrate mapped network drives with a single drag-and-drop. Blog:
1
1
3
🚨 I am publishing my research on the File System API. FileJacking might used to establish Initial Access. Key points: - File smuggling via File System API - Backdooring files directly from a browser - Reading / creating folders and files from a browser https://t.co/9apA0IrNCv
print3m.github.io
FileJacking – Malware Initial Access technique with File System API. Backdoor files, read / write folders directly from the browser – no downloads.
8
47
158
See you in Vegas! 👀✍️📚🎰
Red team vs blue team is so 2019. Our DEF CON special edition of Practical Purple Teaming by @ajpc500 shows you how to build collaborative security that actually works. Real threats, real defenses, real results. Coming to Vegas with the good stuff. 👀
0
0
8
A short GitHub repository explaining on weaponizing WSL file extensions https://t.co/DytprnESX3
#redteam
github.com
A small How-To on creating your own weaponized WSL file - dmcxblue/WSL-Payloads
1
33
107
A few yrs ago, when we began building https://t.co/Un5ApOoI7D, a piece of me wondered if we'd see the innovation and creativity in the threat landscape to justify writing this kind of blog. This is the fifth(!) time we've put together our Top 10 and... the answer is 100% yes 😅
delivr.to
Bringing purple teaming to email. Emulate the latest offensive techniques to measure your stack's effectiveness, track improvement, and quantify the threats that can reach your users.
It's here. The latest iteration of our Top 10 includes the most important developments in initial access tradecraft; from macOS targeting of ClickFix, to Zip Smuggling, to QRLJacking. 📚 Blog:
0
1
13
Cool to see our Sigma rule for FileFix detection being merged today 🚀🩵 https://t.co/WnpN4JSt9U
github.com
Main Sigma Rule Repository. Contribute to SigmaHQ/sigma development by creating an account on GitHub.
Threat actors have wasted no time operationalising the FileFix technique 📁⚠️ 📚Check out our latest blog on detecting and preventing FileFix:
0
0
0
Turns out the same ClickFix mitigation of ‘disabling’ the Win+R shortcut (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - NoRun DWORD 1) also prevents exploitation of the address bar FileFix technique💡
5
76
303
TIL that there's a Defender 365 detection for use of the Microsoft logo from a wiki page - "Phish_HTML_WithMsLogoFromWiki_A" 🤣
4
12
108
My next book is open for pre-orders!!! I have included the first two chapters in audiobook form for free. You can listen to them now on my website or you can listen and read the sample on Apple Books. Looking forward to getting it into your hands. https://t.co/wOlMwj4las
themittenmac.com
https://youtu.be/OnIAmOz0TjoChapter 1https://youtu.be/9bQCWbe2kDwChapter 2Now Available in the U.S.Welcome to my latest book. Threat Hunting macOS—a book that share
2
32
134
Our Phishing Attack Technique Explorer is now live! 😈🔍 Next time you browse our catalogue, you'll see a new view to find payloads combining popular attack techniques; from Pastejacking and Bring Your Own Interpreter, to HTML Smuggling and Auth Coercion https://t.co/gV29vxgOvk
0
9
22
Using Mythic and VECTR on your purple teams? 💜 I’ve just open-sourced a new Mythic service container that allows you to auto-populate VECTR test cases based on your Mythic taskings. https://t.co/Jm7En6gshy
github.com
A service container for interacting with SRA's VECTR - MythicAgents/VECTR
0
21
111