Red team operator and offensive tool developer. Most of my work lives under @Maldev-Academy and in private repositories for my current employer (IOActive). I write about what I can share at cgomezsec.com.
Author of Authentication Downgrade Attacks: Deep Dive Into MFA Bypass.
AiTM phishing against hardened targets like Google using real browser instances via CDP instead of reverse proxies, sidestepping TLS fingerprinting, BotGuard, and anti-bot systems. Also doing FIDO2/WebAuthn research, looking at where passkey implementations break in practice.
Modules on phishing, auth attacks, and cloud identity exploitation. Protocol internals, working implementations, OPSEC. All MFA bypass modules include FIDO downgrade vectors.
|
|
GitHub device code phishing. Minimal setup. |
Same approach for GitLab. Cloud and self-managed. |
Shodan MCP server. Query Shodan from AI assistants. |
Private frameworks shipped alongside the corresponding research modules.
|
Real-time Phishing Framework
Multi-provider credential relay with live error feedback. Real Chrome per target via nodriver/CDP. Google, GitHub, Bitwarden built in. |
Cloudflare Workers AiTM Proxy
Invisible reverse proxy on CF Workers. Rewrites requests/responses on the edge, captures credentials and session tokens. No servers. |
|
Azure AiTM Proxy
AiTM proxy on Azure Functions + Front Door. Legitimate Microsoft infrastructure proxying auth flows. |
Evilginx M365 Phishlet
Custom phishlet with MFA downgrade. Forces FIDO-capable accounts to weaker auth methods. |
|
Google MFA Bypass Framework
BotGuard internals reversing + custom bypass. Real Chrome via nodriver/CDP, Chrome Sync abuse for credential and session theft. Defeats Google MFA end-to-end. |
Passkey Phisher
Targets synced passkeys and hardware security keys. CDP virtual authenticators, downgrade paths, session capture. |
|
ConsentFix Tool
End-to-end ConsentFix attack chain packaged for engagements. OAuth consent abuse with the ConsentFix lure flow. |
Client Fingerprinting Worker
CF Worker that profiles clients before serving content. Anti-bot, sandbox detection, browser fingerprinting, geo filtering. |
Things I work on that aren't public.
 Implant dev in C/C++ and C#/.NET. DLL sideloading, signed binary abuse, BoF development, UDRL custom loader, payload staging. Tested against production EDR. |
 Attack paths, privesc, lateral movement. Azure AD token manipulation, conditional access bypass, cross-tenant abuse. Internal engagement tooling. |
 Training specialist models for offensive security. RL pipeline with feedback from live security products instead of static datasets. |
0xh3l1x