Security research.

2026

1. 01 Threat analysis

   Web compromise investigation and DarkSword analysis

   Finding the injected loader

   While collecting public pages and scripts to measure false positives in a web detection tool, I found an external code loader appended to a JavaScript library. I compared copies retrieved from separate environments to check that the modification was consistent.

   Reconstructing the changes

   I compared archived versions of the resource, locating the last observed clean copy and the first observed modified copy to narrow the possible insertion window. I reviewed archive capture metadata separately from the response bodies available for analysis.

   Tracing browser execution

   I traced how the loader read previously stored code from browser storage, fetched an external response when needed, and executed it. I also followed its fallback script-loading path and examined how stored code could run again on later visits.

   Following related public scan records

   I examined related public scans to connect external loaders with hidden frames and subsequent script requests. I compared response hashes across delivery paths and kept observations from different paths separate when their response bodies could not be matched.

   Analyzing the recovered iOS scripts

   I statically analyzed the available scripts, tracing iOS version checks, Worker loading, device-specific address tables, memory-access stages, native function calls, and requests for later modules. I mapped these dependencies to reconstruct the execution sequence present in the recovered code.

   Comparing with published research

   I compared the recovered code's structure and naming with Google Threat Intelligence Group's published DarkSword analysis. I then organized the loading sequence, supporting observations, missing artifacts, and differences between scan originals and annotated local copies into a report for the relevant authorities.

   ReferenceGoogle Threat Intelligence Group: DarkSword analysis

2. 02 CMS review

   Identified and reported a CMS configuration exposure issue.

3. 03 Source review

   Reviewed authentication implementation in an open-source framework.

4. 04 Web analysis

   Analyzed configuration values exposed in client-side page data.