03 — Cybersecurity Work

Thinking like an attacker,
acting like a defender

Everything here is educational and defensive — no live exploit code, nothing that targets real systems. Just what I learned and how I learned it.

CASE STUDY

ClickFix Malware Script Analysis

Analysis using urlscan.io & VirusTotal — educational, defensive write-up. No live exploit code.

Problem

ClickFix lures victims with fake “fix this error” pages that trick them into pasting a malicious command into their terminal. I wanted to understand exactly how the script works so it can be recognised and blocked.

Method

Loaded the sample in urlscan.io to observe behaviour in a sandbox, then checked hashes and domains on VirusTotal. Traced the redirect chain, inspected the obfuscated script, and mapped each step of the attack.

Finding

The page used a fake CAPTCHA to create urgency, then a clipboard-paste trick to run a PowerShell / shell command. Key indicators: suspicious domains, encoded payload, and social-engineering wording. Detection: block the domains, warn users never to paste commands from websites.

Read the write-up

REPORT

APT Groups — Summary Report

A student summary of Advanced Persistent Threat groups: who they are, how they operate, and what defenders look for. Summary version shared with lecturer’s permission.

Read summary

HOME LAB

My Practice Lab

A persistent home lab where I practise safely and legally — only on machines and networks I own, plus intentionally vulnerable training platforms.

Kali Linux (persistent live USB) Wireshark Aircrack-ng Termux Packet Tracer TryHackMe practice

BLUE TEAM HABIT

Defensive mindset

Every website I build ships with secure defaults — validated forms, keyed APIs out of the client, least-privilege deployments. Attack knowledge is defense knowledge.

Thinking like an attacker,acting like a defender

ClickFix Malware Script Analysis

APT Groups — Summary Report

My Practice Lab

Defensive mindset

Thinking like an attacker,
acting like a defender