Spoke to @zackwhittaker.com about a hacking campaign targeting high-profile Gmail and WhatsApp accounts across the Middle East, found by @nariman.bsky.social earlier this week. Gharib believes the campaign is linked to Iran, TechCrunch was unable to attribute it. techcrunch.com/2026/01/16/h...

The home of Hannah Natanson, a Washington Post reporter, was searched by the FBI. Her devices were seized. I spoke to @columjournreview.bsky.social about the potential damage and what news organizations need to know. www.cjr.org/news/hannah-...

61 flights, 7 new countries, 1 around-the-world trip. Can’t wait to see what 2026 brings.

Excited to be running a workshop on digital security and source protection for investigative journalists in Sweden next year! More info👇 for those who are local.

My latest for Journalist and Spy: Mikhail Vasenkov was a news photographer, professor, and Russian spy. Part of the Illegals Program and arrested by the FBI in 2010. After he died in 2022, the SVR said he helped obtain "valuable political information." www.journalistandspy.com/p/mikhail-va...

I always love seeing what journalism students pull off with the right training and support. This team tracked Russian vessels in Europe and connected them to drone swarms over military bases. www.digitaldigging.org/p/they-drone...

I’ve been told that according to Bjørn Hallstrøm, the computer system used to communicate with his handlers at the CIA in the 1980s/1990s was called “Shamrock.” Does this sound familiar to anyone? www.journalistandspy.com/p/bjrn-halls...

Me in Spain on a random Sunday.

It’s been a year since I wrote this guide for @gijn.org on security best practices for investigative journalists, all of which is still very accurate. Check it out if you haven’t, consider reviewing if it’s been a while. gijn.org/resource/int...

My latest for Journalist and Spy: Pablo González, Russian-Spanish journalist, alleged GRU agent. Wrote for EU + U.S. media, @drewhinshaw.bsky.social & Joe Parkinson say he began working for GRU in 2010. Arrested in Poland in '22, swapped with Russia in '24. www.journalistandspy.com/p/pablo-gonz...

Igor Rogov, who claimed to be a Russian opposition activist when he was arrested in Poland last summer, "has admitted he worked as an undercover agent" for the FSB and "informed on other opposition figures." Rogov is due to go on trial next month. www.theguardian.com/world/2025/n...

If you're not familiar with Masih Alinejad's work and the story of how the Iranian government paid two Russian men $500,000 to kill her in 2022, I recommend reading this piece. The men were sentenced to 25 years in prison in a New York courtroom yesterday. www.theguardian.com/us-news/2025...

Peter Williams, former exec at Trenchant, has pleaded guilty to two counts of stealing trade secrets and selling them to a Russian broker. Williams "even agreed to provide three months’ worth of support or software updates to the products he sold." www.wired.com/story/peter-...

Been a while since we heard from Memento Labs / Hacking Team! This time a government client was caught using an “outdated version of the Windows spyware” and the CEO is “not sure which of the company’s customers were caught.” techcrunch.com/2025/10/28/c...

iOS with Lockdown Mode is still the best defense we have against sophisticated spyware. Here's a snippet from @micahflee.com's keynote at @bsidespdx.bsky.social a few days ago. micahflee.com/practical-de...

Exploit development shop Trenchant, owned by L3Harris, lost a bunch of internal tools in a “damaging leak” recently. A former employee was targeted with spyware, he claims the company designated him as a scapegoat. This should be bigger news, imo. techcrunch.com/2025/10/21/a...

My latest for Journalist and Spy: Bjørn Hallstrøm is a Norwegian TV producer and self-proclaimed spy. He says CIA in 80s-90s asked him to infiltrate groups in Afghanistan, Colombia, Cuba, Kuwait, Libya, and funded shows he sold to media in the Nordics. www.journalistandspy.com/p/bjrn-halls...

I’ve followed various coverage of Havana Syndrome over the years; still interesting to hear what @jenniferpforde.bsky.social and @bungey.bsky.social uncovered in their podcast ‘Havana Helmet Club’ (and I loved ‘West Cork’ from a few years ago). www.bbc.com/audio/brand/...

Been really enjoying this new book about Gunvor Galtung Haavik, a nurse turned secretary for the Norwegian MoFA in Moscow — and KGB spy for 30 years. The KGB used her to get closer to Americans, including Marion Peacock, Lloyd Eddenfield, Bernie G. Britain, and Roy Rhodes.

I’m very excited to discuss journalism and source protection at the @gijn.org conference in Kuala Lumpur next month, alongside @sandrine-rigaud.bsky.social, @thesignalsnetwork.bsky.social, @pm-arnaud.bsky.social, and @paulradu.bsky.social. gijn.org/stories/gijc...

Spent the last week in Taiwan! Such a beautiful country and lots of delicious food. Would love to visit again! 🇹🇼

Working on my skydiving license in between security assessments, keynotes, and research. Here’s my first jump in Empuriabrava, Spain with two instructors and my own parachute.

Thanks to ODA-Nettverk for inviting me to keynote Inspiration Day yesterday! Really enjoyed being back in Oslo and talking about the importance of end-to-end encryption.

Had the pleasure of being a guest on the Adventures of Alice & Bob Podcast recently! Check out the interview for stories about my work with journalists and high-risk people — and that one time I hacked a smart-rifle in 2015. www.beyondtrust.com/podcast/ep-7...

The Kaspersky researchers who discovered Careto more than a decade ago privately concluded that the group was run by the Spanish government. Careto relied heavily on phishing emails impersonating Spanish newspapers. techcrunch.com/2025/05/23/m...

I’ll be in Stockholm in mid-June! Available for consulting, presentations, workshops for journalists and security folks. Also planning on spending some time in the wind tunnel. 🥳

A team of journalists in Norway spent a year secretly monitoring a credit card fraud gang to uncover who's behind it and how they operate. Here's the story -- in English -- of how they unmasked Darcula and the crime-as-a-service software Magic Cat. www.nrk.no/dokumentar/x...

I’m really looking forward to speaking at ODA Inspiration Day in Oslo on May 28! I’ll be there a couple of days prior and would love to meet folks for coffee and/or work. odanettverk.no/2025/04/22/r...

News articles often focus on spyware victims who had their devices checked and opted to go public. We rarely hear about those who didn’t. New court documents from WhatsApp v. NSO shed some light on the true scale of the targeting in a 2019 campaign. techcrunch.com/2025/04/09/c...

More of this, please. bsky.app/profile/prop...

If you’re interested in aviation security, check out this fantastic 2013 talk from Hugo Teso on leveraging ADS-B, ACARS, and on-board systems to attack virtual airplanes systems. www.youtube.com/watch?v=wk1j...

In November, Apple told @davidyambio.bsky.social he was targeted by “a mercenary spyware attack.” Yambio, an activist in Italy, has long criticized Italy’s dealings with Libya. He did not receive a notification from WhatsApp, so unclear what he was targeted with. www.theguardian.com/world/2025/f...

In Chasing Shadows, @rondeibert.bsky.social writes that Ben Hubbard was the first case “of an American journalist being targeted with Pegasus.” Hubbard was targeted in June 2018, but due to “concerns of New York Times management about going public,” @citizenlab.ca didn’t publish until early 2020.

Apple’s Lockdown Mode feature for iOS, iPadOS, macOS, and watchOS remains the best protection we have against sophisticated spyware. Here’s what you should know about the feature, to turn it on: Settings > Privacy & Security. www.glitchcat.xyz/p/four-thing...

The U.K. government doesn't want you to encrypt your iCloud data, which means you should definitely turn on Advanced Data Protection under Settings and iCloud. freedom.press/issues/secre...

In May 1984, two top officials from the Norwegian Police Surveillance Agency visited FBIHQ and participated “as guest lecturers at an Advanced Techniques In-Service” at Quantico. The two men uncovered several illegal Soviet spies in Norway, including Arne Treholt.

On February 6, The Guardian reported that Paragon had “terminated its client relationship with Italy.” Italy is now denying this, saying “Paragon has never suspended the service and has not terminated its contract.” jpost.com/internationa...

Mediterranea Saving Humans has rescued hundreds of migrants at sea; delivered food and medicine to Ukraine in early 2022; and brought 170+ refugees fleeing the war back to Italy. Last year, someone targeted two co-founders with spyware from Paragon. techcrunch.com/2025/02/11/a...

We now know of four people targeted with spyware from Paragon: three in Italy, one in Sweden. Two are co-founders of Mediterranea Saving Humans, an Italian NGO rescuing migrants at sea.

Three individuals have publicly stated they received a notification from WhatsApp about being targeted with Paragon spyware. All three have been critical of Giorgia Meloni, Italy's prime minister. The Guardian reported there may be seven victims in Italy. www.theguardian.com/technology/2...

Paragon and Pegasus have both leveraged WhatsApp to silently install spyware onto people's devices -- with no user interaction. Paragon used the ability to send malicious PDF documents in 2024, Pegasus used the call functionality in 2019. www.reuters.com/technology/c...

I often work with organizations that want to better support staff facing threats and harassment, including doxing. This site by @penamerica.bsky.social is a fantastic resource for victims, allies, and employers. onlineharassmentfieldmanual.pen.org

I love that phone number privacy is the default on @signal.org. This means you can send tips to journalists without sharing your number. You can also choose not to let anyone discover you on Signal by your phone number. support.signal.org/hc/en-us/art...

WhatsApp recently notified individuals in “over two dozen countries” that they’d been targeted with Paragon spyware. Lots of unanswered question still, but good on WhatsApp for referring civil society victims to Citizen Lab for assistance. www.reuters.com/technology/c...

11 months, 11 tunnels, 13:35 hours.

TIL @emiratesairways.bsky.social has in-flight Tetris with a per-plane scoreboard. So next time you are on a 380, go see if my name is listed there.

Incredible reporting from NRK coming out this week: Bjørn Hallstrøm claims he worked for the CIA in the 80s and 90s; posed as a journalist in Afghanistan, Colombia, Libya; and produced documentaries for Norwegian television. www.dagbladet.no/nyheter/jeg-...

Emirates A380 (#EK2552) took off from DXB this morning and now doing training circuits over DWC. www.flightradar24.com/BAW1/38d2997e

The U.S. State Department’s “stop-work-order” for “existing foreign assistance awards” may also include work done by non-profits to benefit civil society abroad — including journalists. www.politico.com/news/2025/01...

I’ve focused on security for at-risk civil society groups for over a decade now (🙀), including human rights defenders, lawyers, and journalists. I’m available for collaboration, consulting, and presenting, so please get in touch if you’d like to work together!