Tricta

About a year ago, Hakai Security introduced the Beerus Framework, an initiative created to centralize security tools and streamline the penetration testing process directly on Android devices. Now, Beerus expands its capabilities to iOS. Following the same approach as the Android version, the framework aims to gather essential tools into a single environment and simplify device preparation for security testing, reducing complex configurations and operational friction during assessments. Authors: Daniel França Lima Daniel, known as Daniboy, is 19 years old, Brazilian, and works as a Pentester and Researcher at Hakai Security. Passionate about understanding how things work, building tools, and manipulating systems. In his free time, he enjoys gaming, especially titles like Hollow Knight, and he also loves foxes. Gabriel Rodrigues @Gabriel52489026 Gabriel Rodrigues, researcher and Pentester at Hakai Security. He has one year of experience in offensive security and holds the CPTS certification. As he says himself: “My friends call me Texugo (Badger) because one of them once said that I look like one." Check out the article on our newly redesigned blog: yokai.hakaisecurity.io/enbee… Github: github.com/hakaioffsec/beeru…

Hakai Security research recognized by Apple! Our analyst Gabriel Rodrigues, from Yokai Research team, was acknowledged by Apple in the security content for macOS Golden Gate 27, following security research related to iCloud that was reported to the company. The technical details of the vulnerability cannot be disclosed yet, so for now, the finding itself will have to remain under wraps. But as soon as we are able to disclose, we'll bring you some technical breakdown for sure! 👀 Congratulations, @Gabriel52489026, on the research and the recognition! 🔥

Apple Security Content:
support.apple.com/en-us/1490…  #HakaiSecurity #SecurityResearch #AppleSecurity #CyberSecurity

Hakai Security dominated Las Vegas! Our team had a massive presence on stage at BSides Las Vegas and DEF CON 34. We delivered 7 high-level technical talks, bringing cutting-edge research on exploit development, reverse engineering, detection evasion, mobile hacking, and APT tradecraft to the global cybersecurity community. Seeing our team in the spotlight at some of the world's premier security conferences reinforces what we believe in: continuous research, innovation, and technical excellence in offensive security. Congratulations to all the speakers for representing Hakai Security and Brazil at such a high level!

About a year ago, Hakai Security introduced the Beerus Framework, a proposal to unify mobile tools in order to streamline the penetration testing process directly on Android devices. The idea was simple: centralize tooling and optimize the testing environment setup, removing the need for complex configurations and reducing operational friction during assessments. Today, after a year of evolution, the framework is no longer just a concept. It has become a robust platform for offensive mobile analysis, gaining international recognition within the community. In this talk, we revisit Beerus in its current form, exploring its evolution, the capabilities that have been consolidated over time, and the lessons learned from real-world scenarios. We also discuss the future vision of the project, covering new features, technical challenges faced during its development, and how the framework can continue evolving to keep up with modern mobile security assessment demands. João Pedro Tricta @_tricta and Daniel França Lima @dd4n1b0y Mobile Hacking Community, Saturday 15:00-16:00 (8 of august) - Brazil 19h DEFCON 2026 defcon.org/ / @wearedefcon ?@defcon

Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust's unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach. This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal "cargo build" via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline - string encryption, basic-block shuffling, indirect-branch obfuscation - recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project's source code, one flag on the command line. We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell's undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja. We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build. Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day. Rafael Felix @biscoitomesmo and João Pedro Tricta @_tricta Malware Village, Friday 10:55-11:35 (7 of august) Brazil 14:55h DEFCON 2026 defcon.org/ / @wearedefcon / @defcon

In this talk, we will cover reverse engineering Windows kernel-mode drivers, identifying vulnerabilities, and performing BYOVD (Bring Your Own Vulnerable Driver) attacks. We will learn techniques to exploit driver vulnerabilities in order to bypass EDRs or gain kernel-level permissions. Additionally, we will review BYOVD attacks carried out by real APTs and how they disable EDRs and antivirus software using kernel-mode techniques. Diego Tellaroli @diegotellaroli Breaking Ground, Tuesday 14:30-15:00, Florentine A (4 of august) BSides La Vegas bsideslv.org/talks

Teams. Outlook. Half your enterprise software. They're all quietly shipping a Chromium browser inside them called WebView2. Murilo Caixeta shows how to turn that trusted, signed process into a genuine red team asset. Red Team Village @theredteamvillage SUNDAY, AUGUST 9, 2026 - 11:00 AM DEFCON 2026 defcon.org/

A few months after the initial release of the Beerus Framework, we are publishing version v1.1, a minor update that brings support for new root environments, a relevant architectural change in data transport, integrated auto-update, and a set of accumulated fixes since the first release. In this post, we detail each change included in this version, the technical context behind each decision, and what it means in practice for those who use Beerus in their day-to-day Android testing. Authors @_tricta and @d3vchac Check it out surl.lt/osfnsr

Today, live from South Korea, we have a presentation by Hakai, with João Pedro Tricta. Zygote is Android’s first process and the template for every app. Its privileged position makes it ideal for system-level injection that can bypass SELinux restrictions. This talk breaks down the end-to-end injection chain, from loader stages to Zygote and process-spawn propagation, then demos my own native and Dalvik (DEX) hooking approach as an alternative to attach-based tools and for research into bypassing RASP protections. João Pedro Tricta is a 20-year-old Brazilian security researcher, malware developer, and Client Applications Squad Leader at Hakai Offensive Security. Passionate about Sysinternals, reverse engineering, low-level internals, and client-side applications, he lives deep in debuggers and disassemblers. When he’s not coding or breaking things, he’s gaming, hanging out with cats, and eating an unreasonable amount of pizza. Linkedin: linkedin.com/in/joão-pedro-t… Instagram: @_tricta Data 28/05/2026 - Horário de Brasília 22:45h Agenda: typhooncon.com/2026-agenda/