About LexLab
Python/Django engineering, email infrastructure, and independent security research.
LexLab is the work of one engineer: Python/Django development, email infrastructure, and independent security research. We reproduce identity attacks against Microsoft 365, Entra ID, Gmail, Yahoo and LinkedIn in an isolated lab, against our own tenants and accounts, and publish the detections, hardening guides and incident-response runbooks that defenders can deploy the same day. The research is free. The commercial services pay for it.
Published research
Seven research bundles, 31 artifacts, all open, no email gate:
- Microsoft 365 AiTM Defense threat model, 3 detections, mitigation guide, IR runbook
- Yahoo / AOL AiTM Defense threat model, detection, mitigation guide, 2 IR runbooks
- LinkedIn AiTM Defense threat model, detection, mitigation guide, IR runbook
- Phishing Redirect Abuse 4 research writeups
- Microsoft 365 OAuth Consent Defense threat model, detection, mitigation guide, IR runbook
- Gmail BitM Defense threat model, detection, mitigation guide, IR runbook
- Microsoft 365 Device Code Defense threat model, detection, mitigation guide, IR runbook
Tools we ship: BitM Shield (Chrome extension, detects Browser-in-the-Middle phishing in real time, open source, MIT) and redirect_analyzer. Both at github.com/lexlabtools.
How the research is done
Every attack we write about is reproduced in an isolated lab environment against infrastructure we own. We do not test against third parties. Detections are validated in real Sentinel workspaces and false-positive behaviour is documented in each artifact. Nothing here is copied from vendor blogs; if we cite prior work, we link it.
Commercial services
These fund the lab.
Python/Django development, server deployment and hardening, DNS, automation, scraping and data pipelines.
Dedicated-IP SMTP (LexlabMTA, LexLab Relay), SPF/DKIM/DMARC alignment, blacklist disputes and delisting, inbox-placement remediation, migration off shared senders.
Detection tuning, Conditional Access design and rollout, AiTM/BitM/OAuth incident response.
VPS and Windows RDP servers.
Not on the list? Tell us the job. If it's in our lane we'll scope it, research anything we haven't done before, and deliver it.
Leo
Python/Django developer and independent security researcher, founder of LexLab Tools. Started as a self-taught web developer; the infrastructure and security work grew out of building and running production systems. Focus areas: Microsoft 365 and Entra ID identity attack surfaces, detection engineering (KQL, Microsoft Sentinel), AiTM and BitM phishing analysis, Conditional Access policy design, and email infrastructure (ZoneMTA, PowerMTA, deliverability).
Contact
For security disclosures, research questions, or service enquiries: support@lexlabtools.com or Telegram.