About

Why 0xBADCAFE?

Programmers have a long habit of hiding words in hex: 0xCAFEBABEat the start of every Java class file, 0xDEADBEEF in memory dumps. BAD CAFE is one more: a valid 32-bit value, and a good name for a place that serves bitter things.

What we research

BAD CAFE studies social engineering where the victim does the last step themselves: pasting a command, installing the "fix", joining the call or running the take-home test. These lures beat a lot of technical controls because the user is the one who acts.

Right now that means ClickFix,SEO luring andinterview phishing. More will follow as the techniques do.

How we handle it

Samples are detonated in isolated labs. Published URLs and indicators are defanged. Write-ups are aimed at defenders, so they explain how a lure works and how to spot it. They're not a kit for rebuilding it.