Blue Team Con 2026

arrow_back View All Dates

10:00am CDT

The Malware Is Coming from Inside the Repo

Sunday September 13, 2026 10:00am - 10:50am CDT

GitHub isn't just where developers work. It's where adversaries stage, obfuscate, and deliver malicious code. Every minute, thousands of commits hit public repositories, and buried inside that firehose are credential stealers, reverse shells, crypto drainers, and the occasional nation-state lure dressed up as a coding challenge. The platform's openness, trust, and sheer volume are exactly what make it useful to attackers: free hosting, free CDN, a developer-friendly domain in every allowlist, and a culture where running npm install or cloning a stranger's repo is just Tuesday.

This talk is about what happens when you actually try to watch all of it.

We'll walk through github-threat-scanner, a pipeline that consumes the GitHub public event stream in near real time, pulls down the code behind every push, and runs it through a stack of decoders and detection rules looking for anything that smells wrong. The interesting problems aren't where you'd expect. Ingesting the stream is easy. Storing it is a solved problem. The hard parts are everything in between: peeling back the layers of obfuscation attackers use to hide payloads, deciding what "malicious" even means when half the internet's legitimate code looks suspicious, and keeping false positives low enough that a human analyst can still trust the queue.

We'll dig into the deobfuscation engine (CyberSaucier), a library of CyberChef recipes that chain together XOR bruteforcing, base64 and hex decoding, packed-JavaScript unwrapping, PowerShell de-munging, and the other tricks that turn a wall of gibberish back into something a detection rule can match on. You'll see which recipes earn their keep, which ones we retired because they were pure theatre, and the surprisingly mundane reasons some decoders fail in production that never show up in a blog post.

Then we'll get to the fun part: who's actually out there. Commodity and Nation State actors treat GitHub Pages as disposable infrastructure. And threading through all of it are the targeted operations: DPRK-aligned clusters running fake job interviews and "technical assessments" that ship trojanized projects to developers at crypto firms and long-running personas that maintain plausible commit histories for months before turning hostile.

You'll leave with a concrete picture of how to build this kind of visibility yourself, what the detection surface actually looks like once you're watching it, and why GitHub deserves a seat in your threat model next to email and the browser. If you run a security team, you'll walk out with questions to take back to your developers. If you write detections, you'll have new ideas for where to point them. And if you just like watching adversaries do dumb things at scale, there will be plenty of that too.

The best part of all of this? Most of this data was initially triaged and analyzed by an autonomous AI analyst running in a throwaway VM in dangerous mode, unafraid of touching actual adversary infrastructure.

No prior knowledge of GitHub internals required. Bring opinions about regex.

Speakers

Justin Borland

Director of Threat Engineering, Abstract

A proven technical leader in the security industry, Justin started his career with a Canadian Secret clearance while still in College. After graduating, he spent the next decade building custom packet capture systems, intrusion detection systems, logging systems, and DFIR tooling... Read More →

Sunday September 13, 2026 10:00am - 10:50am CDT
Swissôtel Chicago 323 E Wacker Dr, Chicago, IL 60601, USA

Talk, Talk Track 1

Company Abstract
Audience Advanced
Subject Threat Intel and DFIR
global Y

12:00pm CDT

From Hours to Minutes With StealerLens: LLM-Accelerated Infostealer IR for Overwhelmed SOCs

Sunday September 13, 2026 12:00pm - 12:50pm CDT

Swissôtel Chicago

Information stealer malware has quietly become one of the most consequential threats facing modern SOCs, with over 50 million stealer logs posted on underground channels in the last year alone. Each log is a comprehensive digital dossier on a single victim, and the sheer volume has created an analysis bottleneck that is impossible to address at scale.
This session opens with a technical deep dive into what an infostealer actually is and the strange artifact that is a stealer log. Beyond the obvious credentials and session cookies, stealer logs contain things defenders rarely expect: browser password manager extension data (BitWarden, Dashlane, KeePassXC), local KeePass vaults exfiltrated from disk, TOTP secrets leaked from Chrome extensions bypassing MFA, cryptocurrency wallet data, personal documents, and desktop screenshots captured at the exact moment of compromise. We will walk through the full attack surface and show why modern stealers are far more dangerous than "just a credential dump".
Buried inside each log are also forensic breadcrumbs left by the malware itself: execution paths, active processes, installed software, browser history, clipboard contents. These artifacts can reconstruct the infection vector and reveal the malware's behavior, but analyzing them manually takes hours per log. For an overwhelmed SOC triaging a steady stream of incidents, this analysis simply does not happen.
Building on our BlackHat USA 2025 work on LLM-based infection screenshot analysis ("Hackers Dropping Mid-Heist Selfies"), we introduce StealerLens, an LLM-powered forensic tool that collapses this workflow from hours to minutes. StealerLens uses a layered architecture where each log artifact (system info, software inventory, processes, browser history, clipboard, screenshots) is analyzed by a dedicated prompt. A final master prompt correlates the outputs into a cohesive infection narrative: likely source of infection, delivery vector, blast radius of exposed information, and pointing to the supporting evidence so the analyst can verify at a glance.
We will share the full prompt architecture, walk through real anonymized cases, discuss the limits we encountered across our test corpus. Attendees leave with a concrete blueprint for industrializing infostealer log analysis — and making room for the strategic work their SOC actually needs to do.

Speakers

Olivier Bilodeau

Principal Cybersecurity Researcher, Flare

Olivier Bilodeau, a principal researcher at Flare, brings 15+ years of cutting-edge infosec expertise in honeypot operations, binary reverse-engineering, RDP interception and, more recently, fighting information stealer malware. Passionate communicator, Olivier spoke at conferences... Read More →

Sunday September 13, 2026 12:00pm - 12:50pm CDT
Swissôtel Chicago 323 E Wacker Dr, Chicago, IL 60601, USA

Talk, Talk Track 3

Company Flare
Audience Intermediate
Subject Threat Intel and DFIR
global Y

2:30pm CDT

AI-Assisted IR Without the Lies: A Browser Forensics Case Study

Sunday September 13, 2026 2:30pm - 2:55pm CDT

Swissôtel Chicago

Offensive security teams are deploying autonomous agents that chain vulnerabilities end to end without human intervention. Vulnerability researchers are using LLMs to discover and exploit zero-days at a pace no human team can match. AI is already on both sides of the fight, and the gap between organizations that harness it and those that do not is widening fast.
Incident responders have largely held back, and for a good reason.
In IR, a hallucination is not a minor inconvenience. A fabricated timeline entry, a missed lateral movement path, or a confidently wrong attribution can mean a backdoor stays in the network, exfiltrated data goes unaccounted for, or an organization remediates a fiction while the real compromise remains intact. The stakes are not just technical. IR findings increasingly inform legal proceedings, regulatory responses, and executive decisions. Forensic evidence analyzed by a system that invents facts has no place in that chain.
And yet: if AI can genuinely accelerate triage and scope analysis, the organizations we respond for recover faster. That matters.
In the past months, we have been solving the precision problem rather than avoiding it. We started with one concrete use case: browser forensics. Using a combination of skills and agents, we built a pipeline that accelerates artifact triage and timeline reconstruction on real engagements.
The pipeline fetches browser history directly from the endpoint regardless of OS, parses artifacts across Chrome and Edge, and searches for relevant entries based on the suspicious activity that prompted the investigation, whether that is a domain, a time window, or a combination of both. What previously required an analyst to manually locate, extract, and cross-reference browser databases is now scoped and surfaced automatically, with the agent linking findings back to the original investigation context.
In this talk, we walk through exactly how we built it, how we validated the outputs, where the model failed, and what we put in place to catch it. We will also share what we learned and how we plan to apply those lessons to other elements of IR going forward.
Attendees will leave with a clear picture of how to structure a skills and agents pipeline for forensic analysis, the specific validation techniques we used to constrain hallucinations, and a realistic sense of where AI-assisted IR is ready for production and where it is not.

Speakers

Kyle Henson

Security Engineering Team Leader, Daylight Security

Kyle is an incident response leader with more than seven years of experience in DFIR and threat intelligence. He is currently a Security Engineering Team Lead at Daylight, where he builds agentic security services such as MDR, threat hunting, and incident response that combine automated... Read More →

Aaron Hau

Security Engineering Team Leader, Daylight Security

Aaron is a security researcher with more than five years of experience across various aspects of Cybersecurity including Incident Response, Red Teaming and Security Research. He is currently a Security Engineering Team Lead at Daylight, where he builds agentic security services such... Read More →

Sunday September 13, 2026 2:30pm - 2:55pm CDT
Swissôtel Chicago 323 E Wacker Dr, Chicago, IL 60601, USA

Talk, Talk Track 2

Company Daylight Security
Audience Intermediate
Subject Threat Intel and DFIR
global Y

Blue Team Con 2026

From $0.00

Tickets

Success you have shared X tickets.

Blue Team Con 2026

10:00am CDT

Justin Borland

12:00pm CDT

Olivier Bilodeau

2:30pm CDT

Kyle Henson

Aaron Hau

Get help with the event

Choose your checkout method

Success you have shared X tickets.

Blue Team Con 2026

10:00am CDT

Justin Borland

12:00pm CDT

Olivier Bilodeau

2:30pm CDT

Kyle Henson

Aaron Hau

Get help with the event