Predict the replies without clicking through.

NEW: Russia cracked activist's phone with Cellebrite. Hunted for political terms @citizenlab.ca found it. Russia's own official docs confirm they did it. Andrey Pivovarov was sentenced to 4 years in prison. Thing is, #cellebrite said had cancelled Russia's contract.. 1/

Effort asymmetry is rude. There is no obligation for me to spend more time reading text you generated than it took you to prompt it.

NEW: malware developers added nuclear & biological weapons text to to their spyware. Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner. Cleanest practical example I can think of for why over-indexing on first order "safety" is risky. 1/

BREAKING: NSO Group caught trying to hack across #WhatsApp. Again! Defying 🇺🇸US Courts. WhatsApp disrupted the Pegasus campaign & says it violates US Federal injunction they won against NSO. Asks Federal judge to hold NSO Group in contempt. Many implications... 1/ about.fb.com/news/2026/06...

The plane with the hantavirus-ill passenger has done a lot of flying since April 25th. Airlink's ZS-YAD spends tonight in Nairobi, with scheduled return to Johannesburg tomorrow morning. I'm curious about what cleaning it might've gotten from Airlink. Here are some more deets 1/

I hope everybody kept their Zoom subscriptions.

PULITZER ALERT: to the team at @apnews.com on how US tech helped turbocharge Chinese surveillance & repression. And fueled surveillances abuses everywhere. Even at home. Took years & faced serious pushback. Tenacious journalism matters & gets us truth despite very long odds.

"The Pulitzer Prize for International Reporting is shared by journalists Dake Kang, Garance Burke, Byron Tau, Aniruddha Ghosal and Yael Grauer." Incredibly well deserved. @yaelwrites.com @byrontau.bsky.social @dakekang.bsky.social

As many are aware by now, @accessnow.org 's annual @rightscon.org was cancelled because of pressure on the host govt Zambia 🇿🇲 by China 🇨🇳 www.rightscon.org/rc26-stateme... In their statement, @accessnow.org rightly flags this is as an example of transnational repression

A manager working for a top surveillance company sold a bunch of powerful hacking tools to a Russian company. Those tools then ended up being used by the Russians. Here's what happens when hacking tools spiral out of control Watch, subscribe here: www.youtube.com/watch?v=MWxL...

NEW: we caught 🇨🇳Chinese hackers... again. Twist: they're hacking journalists & activists, but we suspect they're private contractors. State repression... with a profit margin. Thread + how to protect yourself 1/ By my colleagues @citizenlab.ca + @icij.org citizenlab.ca/research/how...

BREAKING: You checked the weather this morning. And you just told a surveillance company where you sleep. Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones. No warrant required. Our @citizenlab.ca investigation + how to protect yourself 🧵/1 citizenlab.ca/research/ana...

It's a hostage situation. And we want our printers back. Would someone with tokens to burn kindly vibecode the #PrinterLiberationFront?

First, Outlook fails. Now: Houston, Bluetooth won't pair. Artemis II is NASA's most relatable mission yet.

NEW: #WhatsApp shuts down mercenary spyware op, notifies targets. Sends legal warning to Italian spyware shop #SIO. Trick is simple & time tested: govs trick people into installing a malicious version of WhatsApp. Then spy on them. 1/ By @lorenzofb.bsky.social techcrunch.com/2026/04/01/w...

Stop scrolling & watch this. Follow along. Get safer. This especially matters if you're pissing off the powerful. Thanks to @gijn.org for putting this together. www.youtube.com/watch?v=MsPY...

Prolific Russian gov phishing operation now using the DarkSword exploits. Predictable: lots of threat actors have been exploit poor but with great infrastructure for social engineering. When exploits leak from governments they are best positioned to almost immediately start using them 1/

NEW: French sailor reveals position of aircraft carrier with fitness app. His runs track Charles de Gaulle as it steams across the Med. Story by @lemonde.fr 1/ www.lemonde.fr/internationa...

NEW: foreign hacker compromised Epstein files held by #FBI "included combing through certain files pertaining to the Epstein investigation” Source describes it as cybercriminal. Previously all we knew was: there was some sort of breach. 1/ By @raphae.li www.reuters.com/world/us/for...

You used Pokemon Go. You were not the customer. You were the product. By @willdouglasheaven.bsky.social www.technologyreview.com/2026/03/10/1...

6/ In 2022 I warned Congress that commercially-developed exploits would leak. I testified to House Intelligence that the tech would go to adversaries and criminal organizations. That has now happened with #Coruna. And as the commercial offensive industry grows, it will happen again.

BREAKING: powerful iPhone hacking tools used by Chinese criminals originated from US defense giant L3 Harris. Their zero-click exploits went to Russian spies too. Unbelievable harm to our collective security. Scoop: @lorenzofb.bsky.social, here's why it matters 1/ techcrunch.com/2026/03/09/a...

The #FCC is reviewing a proposal for space mirrors to blast sunlight at the earth at night. Sounds awful. Anyone who that been to the far north or tried to sleep under lights knows how disorienting 24h of light is. Everybody gets insomnia. It's also an ecological disaster machinery 1/

We're about to see a new surveillance trap: "Plaid for AI" This will look like slick middleware that seamlessly hooks CRMs to Claude, gmail to GPT-5 etc, etc. UX will be great & founders well-meaning. Then the VCs ask: what else can we do with this sick tokenflow data? 1/

NEW: US just sanctioned a network of exploit brokers trafficking in stolen US hacking tools First-ever use of #PIPA (Protecting American Intellectual Property Act) by Treasury. Here's the wild backstory of how Operation Zero got US-taxpayer funded exploits. 1/

Cellebrite taking a page out of the NSO Group playbook. Denialism is a bad look for a company that tries to frame itself as more ethical than notorious spyware companies. And a good sign that there are deeper issues with the company.

UPDATE: Paragon calls OPSEC fail a tiny price to pay for "female empowerment." Peak cringe. And nonsense. Entire world learned from this pic that their spyware is more invasive than previously known. 1/

Aleksei Navalny was most likely poisoned by a toxin found in a South American frog, five European countries said Saturday, making the most concrete Western accusation yet that Russia’s leading opposition figure was murdered by his government in a prison two years ago. www.nytimes.com/2026/02/14/w...

UPDATE: Ring just cancelled their partnership with #Flock. Should you trust #ring now? No. After all they thought this was a good idea. And their statement doesn't acknowledge the real issue. More on that in a second. But this shows: pressure works on privacy 1/

Epic OPSEC fail by Paragon exposing Graphite spyware capabilities. Annotated pic from what we know. Please help me figure out the other apps in in this pic that the spyware can access: #WhatsApp #Telegram #Signal ? #Line? ? #Snapchat? #TikTok? 1/

🇨🇳In China: agencies budget billions for total surveillance. 🇺🇸In America we buy & install the cameras ourselves.

The showed us cute missing dogs & we consented to turning our doorbell cameras into a mass human tracking system. Mark my words, Ring's Search Party will become the next Flock. Only instead of just being sketchy cameras installed in parking lots, it will be everywhere. That's their play.

A judge in 🇪🇸Barcelona has formally charged two former Civil Guard directors for the first time in connection with the Pegasus #spyware used to spy on the Catalan independence movement. The judge has also summoned former intel. agency CNI director to testify as a suspect. en.ara.cat/politics/two...

A VPN company server was seized. Reminder: your 'privacy' VPN is still a physical server in somebodies jurisdiction. Claim of RAM disk servers as protection is...interesting. I know nothing more about this case, but hotplugs that let authorities grab a server without cutting power are common. 1/

Every AI company in year 1: Bro, we are going to be SO ALIGNED. year 2: YOLO the machine built itself and we can't validate that it's aligned because it knows when we are testing it. Anyways here it is LFG!

Brutal layoffs at the Washington Post today. A lot of reporters of great integrity & talent are suddenly out of a job. This hurts good people & weakens journalism collectively. Wishing them all the best in this tough market.

I trust you, but your AI agent is a snitch: Why we need a new social contract. We’re chatting on Signal, enjoying encryption, right? But your DIY productivity agent is piping the whole thing back to Anthropic. Friend, you just created a permanent subpoena-able record of my private thoughts...1/

In past 24h: ❌ 1-click exploit dropped for #OpenClaw: Simply visiting a URL allowed attacker to steal everything: keys & files + take control of the device. Patched. ❌#MoltBook had a vulnerability exposing all users emails, real names etc. Patched. 1/ Takeaway: all gas, no brakes.

I believe NSO Group has one goal: Bring Pegasus spyware to America. They're trying to create the perception that they are a reformed company. But they just got caught trying to hijack diplomatic efforts to whitewash Pegasus spyware 1/

Someone spun up a social network for AI agents. Almost immediately some began strategizing how to establish covert communications channels to hide from humans. In many cases the agents are on machines that have access to personal data. "Privacy breach" won't begin to capture what is coming. 1/

Huge news out of the UK 🇬🇧 www.reuters.com/world/uk/sau...

Spyware found on Belarusian journalist's phone shortly after interrogation by security services. Reporters w/o Borders: Spyware likely installed while the journalist was detained. The same infection method recently used in Kenya + Serbia. H/t @jsrailton.bsky.social therecord.media/spyware-bela...

Belarusian KGB put spyware on phones of detained journalist. Growing list of cases where authoritarian regimes use detention to implant spyware on phones: 🦠Belarus 🦠Kenya 🦠Serbia And likely plenty more. Important investigation & reminder that dictators don't always need zero-days.

1/ Yesterday’s Q2-Q3 Adversarial Threat Report by Meta was interesting in many ways. For us @citizenlab.ca, it was a blast from the past. For the first time, Meta’s investigators attributed what in 2019 we had named Endless Mayfly - a relentless, sophisticated influence op targeting Iran’s enemies.

In 2019, we @citizenlab.ca published an investigation into a disinfo / influence operation we called "Endless Mayfly", and which we attributed at the time to an "Iran-aligned entity" citizenlab.ca/2019/05/burn... Now, Meta's latest adversarial threat report showing we were spot on 👇

Hotel toilet privacy is disappearing. Glass doors. Or no door. Or a big window into the room. Or frosted glass so that the light spills out. Who is asking for this?

Massive global issue with Cloudflare. App not working? Can't login? Probably why. SO much of the internet depends on Cloudflare to stay online. But what happens when Cloudflare itself goes down? Well, you're watching it.

CRUSHING BLOW TO NSO: 🇺🇸Court permanently bans Pegasus spyware-maker from targeting WhatsApp 🚫Must destroy tools exploiting WhatsApp 🚫Stop future development of WA targeting Foreign gov customers exempt from data deletion but... 🚫NSO is barred from helping them hack WA. 1/