I also had a nice video call with Meg Whitman and some folks on her team when this research came out. There was some very interesting shenanigans being conducted by one of their vendors that I found and they immediately went 10 alarm fire on them about it. Was a solid response plan imo! 🖖

just reported another subtle email address data supply chain breach to a major corporation who yeeted my email to their vendors due to a dumb URL structure -- this problem always comes up! some of my previous research on it: www.nytimes.com/2020/04/29/b...

We need to dramatically improve ad libraries as a core way to slow down scams.

that feeling when you finish and publish the massive client report you've been working on for ages right before the new year

As both the House & Senate look to repeal Section 230, I'm curious who they think should be held liable for the comments they've left open on the Epstein photo dump...? Them? Dropbox? Do they have a trust & safety team watching the comments?

My Youtube account was unsuspended but the video in question is still private. Based on their vague feedback it seems possible that YouTube now has a tool to scrape videos for URLs (like from my screen sharing research session) and then flag videos which in any way reference a known malicious URL.

Today our team at @silentpush.bsky.social released research we’ve been working on all year – a magnum opus 39-page report on the state of Bulletproof Hosting Providers. Brief thread with some details Read the report @ www.silentpush.com/white-papers...

We found the bug in how Vetco generates PDF documents for its customers. Its PDF page was public and was indexed by Google, which is how we found it. Worse, an IDOR bug in the URL meant it was possible for anyone to obtain customer data by changing the customer's unique ID by a single digit. 🤦

Found a "great deal" in about 30 seconds of hunting -- 1k abuse reports on YouTube for $100 - a mere 10 cents per report! This is the type of bot farm product that shit birds use when they want to harass researchers and other folks.

YouTube suspended my ~15+ year old account and all my videos due to a video I recorded about scammers targeting US government and military offices, which was embedded into articles like @ www.vice.com/en/article/w... from @josephcox.bsky.social I was likely targeted by a mass reporting campaign.🤡

The new *free* FireFox VPN which has been tested for months (windowsreport.com/firefox-is-t...) is likely on the horizon for a wider release based on recent comments that a VP / head of Product at Firefox made on Linkedin. Google couldn't even get a free VPN + abandoned their $$ "Google One VPN"

SS7 is gonna remain a dumpster fire security threat and China will continue to exploit it if we can’t even have simple cybersecurity requirements for the telecom industry.

a 5+ year old bug ticket was finally closed by Google - this was actually the last significant investigation into Chrome extensions that I did because the feedback loop was so challenging definitely still a place with research opportunities and threat actors regularly doing weird stuff! 🖖

Everything about this piece from Reuters about the scam ads on Facebook is wild -- internal Meta estimates noted they were showing these scams 15 billion times per day, scammers are not banned just forced to pay more for ads, teams internally restricted, must read: www.reuters.com/investigatio...

fun to see my mom in this crowd shot from the No Kings rally in Houston featured by the Houston Chronicle @ www.houstonchronicle.com/projects/202...

Has anyone ever successfully received data from a personal Yandex data access request? Essentially receiving what data they collect on you as required under a bunch of privacy laws?

I’ve got this 100+ year old copy of an old play about Abraham Lincoln’s life which was owned by someone named Alden Nash who had an interesting personal emblem that he screen printed & glued onto the cover page. The play was shown at the Birmingham Repertory Theatre then the Hammersmith Playhouse.📚

Our team @silentpush just dropped a definitive look at SocGholish (operated by TA569) and the initial access broker ecosystem they are facilitating. Big thanks to past researchers who have worked on SocGholish! We've got details about our visibility @ www.silentpush.com/blog/socghol... 🖖🏻

If I’ve been quiet you know I’m cooking up some fire research! Our team at @silentpush.bsky.social is out today with a big report about the admin / owner of the FUNNULL CDN – essentially a dox of all his accounts and activities on the internet for the last 15+ years.

"Funnull had direct exposure to Huione Pay, for which the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) recently issued a finding and notice of proposed rulemaking (NPRM) identifying it as a primary money laundering concern" 👀

More on Funnull in this Silent Push report from January: www.silentpush.com/blog/infrast... These are also Funnull IPs and domains: bsky.app/profile/camp...

NEW: The U.S. government has announced sanctions against FUNNULL and its administrator. FUNNULL is accused of providing infrastructure for pig butchering crypto scams, as well as being the company behind the Polyfill supply chain attack, which pushed malware to victims who visited certain websites.

The last 6 months I've traveled around the world giving presentations on FUNNULL about the scams and money laundering they are facilitating -- and today -- the U.S. Treasury has sanctioned FUNNULL and we got a bunch more facts about the operation now public. home.treasury.gov/news/press-r...

The location data they will be selling will primarily be powered by Google and Apple’s Mobile Advertising ID schemes - combining that with new data lakes trying to connect scraped social media content to IPs and MAIDs is truly connecting the dots on dystopia.

Adage is out with a new piece today about a data broker product targeting people in Saudi Arabia which doesn't make *any* sense to me. I provided pushback but my comments wern't include -- the piece is "How Coke used an AI agent to target ads to 828,000 fast-food fans" adage.com/technology/a... 🧵

21 year-old money launderer for a $265 million crypto theft ring was helping members exchange crypto for cash and mailing $25k in cash through the mail put inside "Squishmallow" stuffed animals www.cnbc.com/amp/2025/05/... 🫧🐰

Wow what a mess

It's 2015. President Barack Obama has accepted a "sky palace" jumbo jet from the Qatari government, which he'll own after he leaves office. "Everybody relax," he says in an interview with the New York Times. Everyone does. The networks then televise the military parade in his honor on his birthday.

mouse jail is a weird way to encourage accidental clicks victorymedium.com/mouse-jail/

Real-time bidding has been called the biggest data breach in history. Companies like Gravy Analytics are mining tons of personal data from RTB and selling to just about anyone. Zach Edwards @thezedwards.bsky.social explains just how bad it is. podcast.firewallsdontstopdragons.com/2025/04/28/r...

It was an honor and a pleasure to speak at Bsides SF - totally love that they had an artist draw my presentation ⬇️

Interesting thread. North Korea is really moving ahead to the forefront of cyber warfare, possibly moving faster than Russia. Eyes open, ears up and pay attention to your instincts.

NEW: North Korean hackers created and registered at least two companies in the U.S. and used them to target blockchain and cryptocurrency developers with malware. Story with @pearswick.press and Anton Zverev based on research from @silentpush.bsky.social: www.reuters.com/sustainabili...

Our team at Silent Push has been hard at work on the largest report we’ve ever made public – and along with Reuters – today we’re explaining how North Korean threat actors associated with the “Contagious Interview” subgroup created 3 front companies...🧵

Google took down tens of millions of accounts for ad fraud -- how many of these have led to law suits by Google? hmmmm techcrunch.com/2025/04/16/g...

This seems like a casual way to approach internet security in the White House / Executive Buildings…

Did you know some reporters at VOA were unable to use their real names due to fear of attacks against their family abroad? People working at VOA were true patriots and this is a big loss for the U.S..

Two days later, everyone at VOA has reportedly been fired.

“They’re moving fast and breaking things,” Edwards said, quoting the popular tech catchphrase. “With government, if you break things, it can take a long time to fix it.” ⤵️ apnews.com/article/doge...

They are trying to Red Lobster the federal government.

Unconstitutional. Appropriations bills are laws. If the president is not bound by them, he can make laws by fiat and is acting like a dictator. No Democrat can vote for any appropriations or debt ceiling bill while this is happening.

Let's impeach him a second time for the same thing?

The singular organization who has prevented WWIII for decades is being attacked by this administration. We're losing allies, losing trade deals and becoming less safe due to how these folks see Russia as allies and all our traditional allies as enemies. This is completely backwards global diplomacy.

No bid contracts are a thing of the past. Firing key staff and purposefully directing contracts and systems to not be deployed in order to make your own business the only solution to solve a problem is the new grift. This is why oligarchs shouldn't be allowed anywhere near gov contracting decisions.

I had to triple check this was accurate, that the President of the United States is endorsing three garbage crypto tokens tied to countless scandals, and likely untold numbers of investors got a heads up and made bank off the announcement. In the end, this will lose people money & hurt our country.

random thought: google is the data controller for their new Masked Domain List -- orgs not on this list / orgs who have appealed inclusion will be able to collect IP address data on Chrome Incognito. Doesn't G have GDPR obligations to expose data processors / orgs who appealed & get data now?

How often did past administrations send emails to everyone in the government? What technical service does that? How many government workers can be emailed capriciously on a Saturday afternoon from a singular inbox and how many people have to sign off to make that happen? Lots of questions from this.

Our president is surrounded by yes men and he’s been in the pocket for Russia for decades. This should be no surprise and yet it is.

FWIW, the data broker affiliated with Eskimi in this article - RedMob - appears to not be registered with California as a data broker (or Oregon, Texas, and Vermont for that matter). netzpolitik.org/2025/databro... cc: @thezedwards.bsky.social @wchr.bsky.social @josephcox.bsky.social

New from 404 Media: we've identified which specific company is powering the surveillance of U.S. military personnel through location data. It's Eskimi, an Adtech company you've probably never heard of but which has a massive presence in the advertising ecosystem www.404media.co/eskimi-2/