Red team operator and offensive tool developer. Most of my work lives under @Maldev-Academy and in private repositories for my current employer (IOActive). I write about what I can share at cgomezsec.com.
Author of Authentication Downgrade Attacks: Deep Dive Into MFA Bypass.
AiTM phishing against hardened targets like Google using real browser instances via CDP instead of reverse proxies, sidestepping TLS fingerprinting, BotGuard, and anti-bot systems. Also doing FIDO2/WebAuthn research, looking at where passkey implementations break in practice.
Modules on phishing, auth attacks, and cloud identity exploitation. Protocol internals, working implementations, OPSEC. All MFA bypass modules include FIDO downgrade vectors.
|
||||||||||||||||||||||||||||||||||||||||||||||||
|
In Development
|
|
GitHub device code phishing. Minimal setup. |
Same approach for GitLab. Cloud and self-managed. |
Shodan MCP server. Query Shodan from AI assistants. |
|
Real-time Phishing Framework Multi-provider credential relay with live error feedback. Real Chrome per target via nodriver/CDP. Google, GitHub, Bitwarden built in. |
Cloudflare Workers AiTM Proxy Invisible reverse proxy on CF Workers. Rewrites requests/responses on the edge, captures credentials and session tokens. No servers. |
|
Azure AiTM Proxy AiTM proxy on Azure Functions + Front Door. Legitimate Microsoft infrastructure proxying auth flows. |
Evilginx M365 Phishlet Custom phishlet with MFA downgrade. Forces FIDO-capable accounts to weaker auth methods. |
|
Client Fingerprinting Worker - CF Worker that profiles clients before serving content. Anti-bot, sandbox detection, browser fingerprinting, geo filtering. |
|
Things I work on that aren't public.
 Implant dev in C/C++ and C#/.NET. DLL sideloading, signed binary abuse, BoF development, UDRL custom loader, payload staging. Tested against production EDR. |
 Attack paths, privesc, lateral movement. Azure AD token manipulation, conditional access bypass, cross-tenant abuse. Internal engagement tooling. |
 Training specialist models for offensive security. RL pipeline with feedback from live security products instead of static datasets. |
0xh3l1x