Marcus Hutchins :verified:

Cybersecurity

Public Key

npub1t5y3qpya5m4v4tv73yw447uglfsn7j44znv2d38m2xsrah4kpm0qt338yv

NIP-05 Address

malwaretech@infosec-exchange.mostr.pub

Profile Code

nprofile1qqs96zgsqjw6d6k24k0gj826lwy05cflf263fk9xcna4rgp7m6mqahspz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qz9thwden5te0wfjkccte9ekk7um5wgh8qatzxj32l9

Publishing to

relay.ditto.pub

relay.mostr.pub

Author Public Key

npub1t5y3qpya5m4v4tv73yw447uglfsn7j44znv2d38m2xsrah4kpm0qt338yv

Show more details

Last Notes

2026-09-03 23:38:17 UTC

Machine Speed is a lie: stop trying to fight AI with AI
Marketing departments are screaming that attackers are moving at "machine speed" and only AI-powered defenses can stop them. But cyberattacks have always been automated, and proactive defense beats reactive AI.
https://malwaretech.com/2026/09/machine-speed-is-a-lie-stop-trying-to-fight-ai-with-ai.html?a=1

2026-08-21 22:33:55 UTC

- reply

@nprofile…c808 LMAO

2026-08-21 21:42:51 UTC

- reply

@nprofile…c808 I think I skipped that one lol

2026-08-21 20:39:01 UTC

- reply

@nprofile…j6r5 Thank you 🙏

2026-08-21 20:38:31 UTC

- reply

@nprofile…c808 I've seen it on servers, but I don't remember it on desktop machines. Though if it was an XP thing, then I've probably long since forgotten about it

2026-08-20 22:46:04 UTC

Found an interesting new malware loader which creates a fake Windows lock screen to phish the user's system login password. The fully-modular loader also bridges multitude different programming languages, including: Python, C#, C++, and PowerShell.
This extensive use of cross-language components, along with shipping an entire runtime environment, lead to us dubbing it SynkLoader (Sink Loader), because it brings everything but the kitchen sink.
While the original loader runs all of its modules in memory only, we were able to collect them by reverse engineering the command-and-control protocol, then building our own version of the loader which logs everything to disk.
Additionally, we were able to to lure the operator into thinking they had a reverse shell on our honeypot system. This allowed us to watch as they attempted to execute PowerShell commands, which were being printed to our system's console instead of being run.
Full analysis: https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/130/261/917/603/926/original/8216fa944fb73203.png

2026-07-23 22:58:46 UTC

- reply

@nprofile…ftad In my experience intelligent people don't desperately try to sound smart by invoking every fallacy name they can think of when losing an argument. Best of luck with whatever the fuck you're trying to accomplish in life, but you're getting blocked now.

2026-07-23 22:54:22 UTC

- reply

@nprofile…ftad No, I just think you're an idiot. I make videos for an audience who wants to hear my takes on mainstream cybersecurity news. You are either one of them, or you're not. If it's the latter, then you can just scrolled past instead of leaving your uninformed opinion.
A very important media literacy skill is knowing when some media is intended for you. If it's not intended for you and you respond as if it were tailored for you specifically, you just end up looking like a fool like you do now.

2026-07-23 22:47:41 UTC

- reply

@nprofile…ftad Only to people who aren't smart enough to at least watch the first 5 seconds of the video before commenting

2026-07-23 22:45:35 UTC

- reply

@nprofile…ftad there's no "sorry that you think that". You came in and accused me of having no self-awareness, then backtracked to try and claim I was doing something that I did not do. You're a grade A clown. I title my YouTube videos so people watch them, not to appeal to 1 weird nerd on a niche social media platform.

2026-07-23 22:00:27 UTC

- reply

@nprofile…ftad yup, and that's why it got 10,000 views in less than 24h, instead of if I'd used my alternate headline option of: "A deep dive into OpenAI's claim that their model escaped a sandboxed and hacked hugging face, where I debunk said claim and talk about OpenAI's reckless behavior and also include my life story in this headline because why not and also I had eggs for breakfast btw"

2026-07-23 21:54:48 UTC

- reply

@nprofile…ftad This whole post reads like a neckbeard trying to sound intelligence. It's 2 paragraphs of "well akshully".
If you'd watch the video you'd know I spent the whole video tearing apart OpenAI and debunking their BS claim, but you didn't because you think judging a book by its cover and inventing the story is an intelligent way to behave.

2026-07-23 21:41:30 UTC

- reply

@nprofile…ftad Telling people they don't have any self awareness isn't good advice. For it to be even advice, there would have to be, you know, some advice. All you provided was an ad-hominem attack.
Your second reply (this one), would be easily remediated by you having actually watched the video, instead of just guessing at what you think I said in it.

2026-07-23 17:51:20 UTC

- reply

@nprofile…fnex @nprofile…g5t3 The post very clearly and explicitly addresses that.

2026-07-23 05:57:39 UTC

- reply

@nprofile…ftad I forgot how insufferable people on this platform are

2026-07-23 01:45:41 UTC

- reply

@nprofile…tg2e Respectfully, nobody asked. Either watch the video and critic the content, or stfu.

2026-07-22 21:44:21 UTC

My take on the story about OpenAI's model going rogue and hacking a competitor's systems, why it matters.
Also probably the fastest turnaround time for a video that I've managed so far. I'd just got off a 12h flight when the story dropped.
https://youtu.be/GB8gaeI0fLs?si=ss3hD78xG2XUREYn

2026-06-30 15:51:55 UTC

My deep-dive technical analysis of a zero-day exploit being used by The Gentlemen ransomware group to disable EDR products
https://expel.com/blog/not-very-gentlemanly-analyzing-a-zero-day-exploit-used-by-the-gentlemen-ransomware-to-disable-targets-edrs/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/839/855/824/190/409/original/7efbe6019a47a231.png

2026-06-28 09:32:13 UTC

- reply

@nprofile…qtft I’ve never requested or submitted a CVE before

2026-06-25 20:07:45 UTC

I think it’s hilarious that I now have my first CVE because I got annoyed with an unresponsive vendor and just posted the zero day exploit I was trying to report to them on my GitHub 😆
https://nvd.nist.gov/vuln/detail/CVE-2026-49494

2026-06-04 20:28:32 UTC

- reply

@nprofile…0rz0 Someone needs to check the office water coolers at Redmond. I think it might have gotten filled with lead

2026-06-03 23:51:31 UTC

ComoDoS - Exploiting a Remote Kernel Zero-Day Vulnerability in Comodo Internet Security
How an IP parsing vulnerability makes it possible to remotely crash systems with a single TCP/IP packet
https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/688/843/678/322/929/original/6e66f663035431cf.png

2026-06-03 10:28:10 UTC

It's been a while since I did a vulnerability research article. How about a little DoS zero-day as a treat?
https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html

2026-06-03 10:26:56 UTC

It's been a while since I did a vulnerability research article. How about a little DoS zero-day as a treat?
https://malwaretech.com/2026/06/exploiting-a-remote-kernel-pool-overflow-in-comodo-internet-security.html

2026-05-29 09:36:09 UTC

- reply

@nprofile…xjw4 lol, wild. Really cool to see though

2026-05-29 09:33:24 UTC

My thoughts on Microsoft's threat to prosecute researchers for dropping zero day exploits
https://www.youtube.com/watch?v=gCkfWo5rie8

2026-05-24 17:18:48 UTC

- reply

@nprofile…g4vn That is indeed oddly specific

2026-05-24 05:16:24 UTC

- reply

@nprofile…ly0t Not sure what you mean

2026-05-24 05:16:09 UTC

- reply

@nprofile…wcq8 I keep forgetting every time I upgrade it

2026-05-23 19:57:17 UTC

Slowly setting up my video/livestream studio again. The amount of tech required for even a half decent experience is crazy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/625/652/354/646/999/original/8e9df7a1f80504b4.png

2026-05-08 06:09:57 UTC

- reply

@nprofile…vlzd Nice work dude! I assume this locks down the ABE bypasses that work via injecting into the broker and hijacking the COM session?
Does it also apply to Chrome processes launched via CreateProcess suspended for process hollowing purposes?

2026-05-07 18:36:32 UTC

I found a zero day in a security vendor's firewall software that allows you to remotely crash the entire system by sending it a single malicious packet. Since the firewall is responsible for inspecting traffic prior to the operating system handling it, no ports even need to be open for it to work.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/738/287/375/008/original/2eb9415580efecdf.mp4

2026-05-05 05:24:43 UTC

I built an AI that autonomously finds zero day exploits https://www.youtube.com/watch?v=BLqRiL_GY3A

2026-04-30 14:23:27 UTC

Listening to cybersecurity people freak out over Mythos is so tiring. Like, bro, your local water treatment plant runs Windows XP, your mobile provider's hardware is older than you are, and the protocol that routes internet traffic is secured by everyone just agreeing that hijacking it would be uncool.

2026-04-23 00:03:34 UTC

- reply

@nprofile…79s7 Before Mythos is was zero day exploits in general. Cybersecurity has always been fixated on novel, rare, and unrealistic attacks while ignoring the hacks that happen on a daily basis

2026-04-22 20:24:51 UTC

- reply

@nprofile…8xvk Thank you 🙏

2026-04-22 20:23:50 UTC

- reply

@nprofile…awmc I have less than zero interest in justifying 4 months of my own extensive intelligence work to some dipshit tankie

2026-04-22 17:11:34 UTC

I spent nearly 4 months investigating the inner workings of a North Korean state-sponsored hacking group. Here's what I found:
- The group used generative AI tools to aid in almost every part of their operations.
- They exfiltrated 26,584 cryptocurrency wallets from victim systems, with a combined value totaling as much $12 million dollars.
- In several cases, the threat actors set up entire front companies to lure in developers via fake job posting, then infected them with malware.
- The threat actors successfully pulled off a supply-chain attack by compromising a VS Code extension developer's system.
🔗 Full article: https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/449/467/710/810/251/original/35e5acafddc8279f.png

2026-03-18 23:53:59 UTC

After years of planning a potential collab, I finally got to sit down with fellow cybersecurity YouTuber David Bombal for an in person interview! Below you can check out the video from what will hopefully be the first of many more collaborations 😃 :
https://www.youtube.com/watch?v=KsXzTz5H2QQ

2026-03-12 06:53:54 UTC

I'm convinced this technology was invented purely just to troll me
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/214/885/039/361/548/original/51af03680fc2daa9.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/214/885/037/108/488/original/b31ecbc1193baba5.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/214/885/058/629/164/original/ed396b5f8144aab3.png

2026-03-09 16:45:14 UTC

- reply

@nprofile…8d39 I think you're probably right. I see similarly aggressive responses when talking about how VPNs don't protect you from surveillance. People seem to be uncomfortable with the idea that serious privacy is actually difficult and not just something you can buy

2026-03-09 07:37:09 UTC

- reply

@nprofile…svlt pretty sure it is

2026-03-09 07:35:15 UTC

- reply

@nprofile…86zm nah, it’s definitely not this one. My LinkedIn connections are actual domain expert not a bunch of “tech savvy” vpn fanboys

2026-03-09 05:18:04 UTC

- reply

lol, this post really brought out all the insufferable fanboys. I'm not gonna pretend like I didn't know which of the 3 platforms I posted this on would have a bunch of people deeply personally offended by criticism of a corporation
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/197/505/970/823/704/original/df915c7f1d605115.png

2026-03-09 05:06:16 UTC

- reply

@nprofile…p9tu ya'll fanboys are insufferable

2026-03-09 02:06:37 UTC

- reply

@nprofile…w0mx God, you're insufferable. Enjoy the block list.

2026-03-09 00:10:17 UTC

- reply

@nprofile…w0mx "feedback" is not what I'd call that, unless you meant your intention was for the recipient to feed it back into their shredder.
All you did was make a bunch of baseless and asinine assertions, then accuse me of spreading "FUD" by... *checks notes*
explaining how the law actually works.
You get what yo give

2026-03-09 00:07:47 UTC

- reply

@nprofile…w50c "feedback" is not what I'd call that, unless you meant your intention was for the recipient to feed it back into their shredder.
All you did was make a bunch of baseless and asinine assertions, then accuse me of spreading "FUD" by... *checks notes*
explaining how the law actually works.
You get what yo give

2026-03-08 23:02:01 UTC

- reply

@nprofile…w50c No, Apple just outright refused and has enough money to tie most of the federal government lawyers up in court for the rest of their careers

2026-03-08 23:00:23 UTC

- reply

@nprofile…w0mx Each sentence of your comment is increasingly dumber than the last. "We’re all aware that international treaties exist" yeah, your average internet user definitely understands international legal assistance processes.
There's nothing "FUD" about my statement. It contains only facts which enable users to better inform their decisions.
"breaking US tax law is unlikely to have any impact on Swiss authorities" Is an extremely funny statement given it was the US who forced Switzerland to roll back some of it's bank secrecy laws so the US could go after tax evaders.
If you're gonna accuse me of spreading FUD, at least put in a modicum of effort.

2026-03-08 22:29:52 UTC

It feels like Proton are being intentionally misleading in their statements. They know that most of their customers aren't familiar with how legal process actually works, so are happy to spread half-truths.
Under US law, a US law enforcement agency (LEA) typically has to apply for a subpoena or search warrant with a US court. The court is then responsible for deciding if the legal bar for search a request has been met, then either grants or denies it.
The problem is, if a company has no real US footprint (no US corporate entity, offices, servers, etc.), then a US court typically doesn't have the jurisdiction to compel the company to hand over customer data (except in some rare circumstances). Even if the court approved the warrant anyway, it wouldn't really be legally binding.
Which is why the Mutual Legal Assistance Treaty (MLAT) exists. MLAT enables law enforcement agencies in one company to send requests for information to law enforcement agencies in another. Switzerland has such a treaty with the US. This means that the FBI can request that Swiss authorities hand over a Swiss company's data on their behalf.
Any country requesting information held by a company in a foreign jurisdiction would typically do so via MLAT. Which means from Proton's perspective, the legal request would appear to originate from their local law enforcement, not the FBI. Which they clearly understand based on their Reddit post.
Saying "we don't respond to legal requests from anywhere other than Swiss authorities" seems very intentionally worded to give the impression that the company does not cooperate with foreign law enforcement. But since it'd be the Swiss authorities handling any such requests, they'd have to comply, since as they admitted, they have to comply with local laws.
There is, however, some useful (but more nuanced) information here:
Firstly, MLAT requests are handled by local law enforcement according to local law. So if there is a difference between the law of the sending and recipient country, that might mean the MLAT request is denied. That probably doesn't mean much, because if you're on the FBI's radar, the chances are you did something that is also massively illegal in Switzerland too.
Secondly, they are 100% correct in saying that no other service provider is going to do any better. They're all beholden to local laws, and the ones that think they're not tend to get their doors blown off by SWAT like CyberBunker did. The only exception is if the company resides in a country which does not cooperate with US law enforcement (which Proton does not).
But the part that's extremely disingenuous is that the "we only respond to requests from the Swiss authorities". That statement is likely intended to imply they don't cooperate with law enforcement in any other countries, which is simply not true. Switzerland has MLAT agreements with over 30 counties.
People really need to understand that no company is going to shield you from the FBI (or any reputable law enforcement agency). They'll use misleading statements to make it sounds like they don't cooperate with law enforcement, but they do. They have to.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/195/916/812/004/684/original/c9b267c29540586b.png

2026-03-05 18:09:35 UTC

Great crowd at Zero Trust World today. Thanks for everyone who came to my keynote and for all the great hallway conversations! 😃
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/177/906/849/825/840/original/a4da85095c482855.jpeg

2026-03-02 13:44:35 UTC

To prove you’re not a robot, please select all the Mar-a-lago SCIFs
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/159/877/899/578/499/original/3a626656b7fa7d9a.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/159/877/890/164/232/original/adbeb2ca8060cd19.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/159/877/900/492/849/original/130cb3068cc24998.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/159/877/896/966/692/original/012fdd246ad1d72f.jpeg

2026-02-25 06:09:07 UTC

We plan to decrease operational costs for our AI model by building custom servers that are immune to cosmic radiation, then spending trillions of dollars launching them into space. Yes, our CFO did tech themselves math using ChatGPT, why do you ask?

2026-02-24 20:52:06 UTC

Anthropic when Chinese companies use Claude to train their own AI models vs Anothropic when they’re stealing everyone’s data to train Claude
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/127/585/108/948/125/original/f474ce1657d0aa13.jpeg

2026-02-08 20:59:15 UTC

When the state sponsored threat actor has vibe coded their entire control server, all the login code is client-side, and they’ve infected themselves with their own malware.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/037/016/208/070/006/original/211e71447c96776e.jpeg

2026-01-20 23:38:11 UTC

Since the decline of peer-to-peer botnets it's been difficult to track malware infection externally. But smart contract based C2 infrastructure provided us with unique insights into this campaign.
https://expel.com/blog/clearfake-new-lotl-techniques/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/930/057/273/141/624/original/cd7828f8e4bd2c11.png

2026-01-20 21:14:51 UTC

My latest blog post investigating a malware campaign which infects victims by utilizing only legitimate infrastructure. The malicious activity spans hundreds of hacked websites, the BSC blockchain, and a popular CDN.
https://expel.com/blog/clearfake-new-lotl-techniques/

2026-01-19 21:55:42 UTC

Just checking in on my investment portfolio, because apparently computers are appreciating assets now.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/923/991/975/311/652/original/7ad2f28be58d8953.jpeg

2026-01-17 03:42:55 UTC

I've been researching some malware that uses Blockchain Smart Contracts as Command-and-Control infrastructure. Since blockchain data is public, I was able to write code to track how many new systems the malware infects each day. Blog post coming next week.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/908/370/393/956/542/original/c16b0d7d11059913.png

2025-12-29 19:46:55 UTC

This week doesn't exist, so come hangout, ask questions, talk tech & current events.
Going live at 12:30 PST.
https://www.youtube.com/watch?v=2dSIuG2__OQ

2025-12-27 18:08:11 UTC

One concern about the AI bubble that I've not yet seen discussed is how many All-In podcasts it's going to create. Every time one of these AI companies is bought or IPOs, it creates like 10 new billionaire who will start a podcast where they pass their single brain cell around a table and influence people on issues they know nothing about.
Remember when David Sacks and Jason Calacanis got together with Elon Musk and tried to sabotage Ukraine's defense because they convinced themselves that angering Russia would lead to a nuclear war? Now imagine there's 400 of them. At this rate the entire media sphere will just be midwit billionaires with podcasts.

2025-12-22 20:03:14 UTC

Come join the Holiday hangout stream!
Ask question about Hacking, Cybersecurity, Tech, or go completely off topic if you like :)
Going live at 12:15 PST.
https://www.youtube.com/watch?v=HnIoiI8_1cw

2025-12-19 21:41:20 UTC

Walking through how North Korean hacks job applications using malicious coding challenges, and now you can avoid falling victim. https://www.youtube.com/watch?v=ci7Tv0KhQjM
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/748/403/880/259/675/original/ba2a9a0b1b37fcbf.png

2025-12-15 17:38:26 UTC

The tariffs certainly appear to be working. American companies are no longer importing goods from China. Instead, they're becoming Chinese companies and producing good domestically.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/724/799/528/162/680/original/d2f4f8a00ab0abb7.png

2025-12-13 21:49:26 UTC

The political theory of "everyone is twelve now" really is undefeated. None of this propaganda makes any sense until you realize the target audience never intellectually or emotionally developed past middle school. Just picture a bunch of giddy kids clapping along like "haha the turtle has an RPG, and they've photoshop Santa hats onto the secret police". That's their voters.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/714/461/841/976/102/original/b1f211aa0d6c6473.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/714/461/848/617/998/original/3034da219d6ca7f0.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/714/461/846/465/228/original/1664c388bb8dba62.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/714/461/850/124/414/original/7cf4eb2160cf2280.png

2025-12-13 20:55:48 UTC

Ever since Amazon ruined 30,000 people's holidays be laying them off in the name of "efficiency", they've massively improved their next day delivery system. It used to be that I'd only get one next day delivery per package, but now I get 5 for the price of one. Every day they tell me it's arriving the next. Incredible value for money!

2025-12-11 19:59:28 UTC

Is it me or are major internet platform outages getting more frequent? I used to instinctively reboot my router, now I just assume it's the platform. GitHub broke for me this morning, now LinkedIn is offline. Reddit and Twitter feel like they go down twice a week. Meanwhile all these companies are bragging about layoffs because they've "become more efficient with AI". Like, dawg, you can't even keep your website online.

2025-11-28 20:20:29 UTC

Here's an easy way to understand the US "hacking back" / Offensive cyber operations proposal: You lose the keys to your house down the back of the couch. It would be very time consuming to try and dig them out, but buying new locks would cost money.
The least expensive option is to simply remove the entire front door, which your family approves of. This would leave more money to gamble in the slot machine (some guy who says he is 100% definitely not the owner of the slot machine has told you that if you put in enough money, you will receive a return on your investment).
After voting to remove the front door, someone walks into your house and steals your TV. Having to buy a new door, new locks, and new TV would cut into the slot machine fund. Which is unacceptable.
You decide the most cost efficient option is to track down every thief in the world and punch them in the face. The family agrees that punching every thief in the face would certainly deter any further theft, and have absolutely no possible negative consequences at all.
The not slot machine guy has also offered to buy all your house's windows for $30, to help you recuperate some of the losses from your TV being stolen. You agree that this is indeed a good deal, and proceed to remove every window.
One day you come come to find a 600 pound grizzly bear rooting around in your pantry eating all your food. Your are completely perplexed. Despite your best efforts to secure your home against theft, people have still been walking in and taking whatever they want. However, a grizzly bear is new.
You consult with the not slot machine guy, who has recently used all his not slot machine money to buy up every local hospital. You are concerned that the punching everyone in the face policy does not appear to have affected theft rates. Also, this policy was designed for humans, not bears.
The not slot machine guy reassures you that this is the best way. He tells you that you just aren't punching people hard enough. He also says that there is no reason why the same policy couldn't also be applied to bears. He sells you some punching classes for $5 trillion dollars and send you on your way.
With your new found punching skills, you are now ready to fight the bear. You return home to find out that all of the local bears have learned that your pantry is a great place to get food. There in now an entire group of them. That is ok though, you've been training for this.

2025-11-23 20:56:59 UTC

Weekend Hangout Stream starting in 10 minutes
Ask questions, talk tech, chat about current events, and just hang out
https://www.youtube.com/watch?v=uOpgJval1vc

2025-11-20 17:48:01 UTC

It always makes me chuckle how occasionally you'll run into beginners who say stuff like "real hackers use Linux". Real hackers aren't constrained by operating system choice. In fact, half the fun is running into that weird edge case where you end up having to code your own OS for some hyper-specific task.

2025-11-17 04:57:28 UTC

Do You Need To Worry About China's Agentic AI Cyberattacks?
https://www.youtube.com/watch?v=siZaZf3lK_8

2025-11-14 18:10:06 UTC

- reply

@nprofile…ppe2 @nprofile…9gze There's a lot of good argument's against the Chinese AI hackers claim but "I can't figure out how to jailbreak an LLM, therefore China can't" isn't one. The real question is about what value they're getting out of LLM automation that scripting couldn't provide.

2025-11-13 07:36:28 UTC

This post from the President of Windows basically reads like someone trained an LLM on those SF billboards that just say incomprehensible nonsense.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/541/238/524/941/100/original/f5ed0b44f69f166d.png

2025-11-09 22:35:06 UTC

Just introduced a new category of reverse engineering labs: Multistage. Multistage labs simulate full malware attack chains based on real-world malware campaigns. These labs are designed to familiarize malware analysts with reversing more complex infection chains, rather than just standalone malware samples.
https://malwaretech.com/labs/multistage/

2025-11-06 18:54:28 UTC

Check out my new interview with The Hacking Games! I discuss how I went from being arrested by the FBI to advising law enforcement on creating intervention programs, helping redirect young hackers before they end up in jail.
https://www.youtube.com/watch?v=Qs2Qb5VK9Uc

2025-10-30 16:27:51 UTC

Watch OpenAI go public and just follow Tesla's business model (convincing retail investors to shovel their money into a fire while announcing "AGI is coming next year" every year forever).

2025-10-28 15:57:22 UTC

- reply

@nprofile…dyc7 my job

2025-10-28 02:50:39 UTC

- reply

@nprofile…dyc7 I doubt there are raw numbers available as that would require some way to publicly track zero day attacks (many of which go undetected, or are not disclosed publicly).

2025-10-28 02:46:09 UTC

- reply

@nprofile…syqt 1-day is more widely considered to be a bug for which a patch has just been released. It doesn't really make sense to differentiate between whether or not a company is aware of a bug, because that's typically impossible to confirm, nor is it typically know if they plan to actually patch it. All that really matters from a customer perspective is whether or not a patch is available.

2025-10-28 00:55:13 UTC

This would be extremely significant. China implemented a similar law in 2021 requiring security researchers to report zero day vulnerabilities to both the software vendor and the Chinese government. It was followed by an absolutely massive explosion in zero day use by CN state sponsored groups.
I suspect it not only lead to a huge increase in the number of zero day exploits China was in possession of, but also their calculus on how and when to use them.
Normally, zero days are used very sparingly. There is always a risk they will be detected and patched. However, if the vulnerabilities are being simultaneously reported to the vendor and the intelligence services, they're getting patched anyway. There's very little downside to using them, and only a small window to do so.
I can't say 100% the legislation change is what caused the changed in behavior, but since then, there have been many documented cases of Chinese APTs using high value zero day exploits to indiscriminately hack systems. Not just high value targets, basically anything with an internet connection.
https://risky.biz/risky-bulletin-russian-bill-would-require-researchers-to-report-bugs-to-the-fsb/

2025-10-24 21:28:57 UTC

- reply

@nprofile…dzzd Gonna look into this, thanks

2025-10-18 23:46:49 UTC

Just released a new malware analysis lab: Command & Control 3.
This lab tests provides an introduction to multi-stage malware loaders. Your job is to reverse engineer the command & control protocol, then write a script to retrieve the second stage payload. Inside the second stage payload you'll find the flag.
https://malwaretech.com/labs/c2/command-and-control-3

2025-10-17 15:44:02 UTC

- reply

What's hilarious is I can't even tell if you had to do some creative prompting to get that output or that was its verbatim response to just the text in the post

2025-10-17 15:03:38 UTC

You know how billionaires end up with severe cognitive deficits as a result of becoming surrounded by yes men who constantly tell them their every idea is genius? What if we made a bot that just does that to everyone. I think that would be great.

2025-10-16 01:45:51 UTC

It’s really hard to tell what’s AI and whats real when a bunch of ICE goons kidnapping a giraffe in a thong for singing is just America in 2025
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/381/315/128/660/603/original/b73f24a84e55e7f4.mp4

2025-10-08 18:25:31 UTC

- reply

@nprofile…32kp idk, it looks like they put together a bunch of techniques from red team blogs and didn't think super hard about it

2025-10-08 17:38:59 UTC

- reply

@nprofile…0jv6 Nah it's ok, nobody is looking to hack Linux users

2025-10-08 16:41:45 UTC

We encountered a unique variant of the ClickFix malware technique. The catch? The user is social engineered into running a PowerShell script which downloads no files, makes no web requests, and embeds no payload.
Regardless, it's still able to install a malicious loader to maintain a foothold on the infected system. Check out my latest blog post to find out more:
https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/

2025-10-03 23:04:35 UTC

Looks like the 3rd party platform Discord uses for support tickets got breached and someone was able to gain access to Discord user information as well as trust & safety reports
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/312/733/307/736/834/original/53d654fc338cb929.png

2025-06-14 17:30:50 UTC

In response to popular demand, we've added some offensive security channel to the MalwareTech Discord. Interested in pentesting, red teaming, or implant development? Check out channels #offensive-security, #vulnerability-research, and #implant-development.
https://discord.gg/MalwareTech

2025-06-12 19:53:51 UTC

The wonderful world of technology: I can't read my (physical) mail, because Cloudflare is down and the mailroom uses electronic access control.

2025-06-11 16:27:33 UTC

Added a new Wiki entry: Locating Modules Via The PEB (Process Environment Block)
Should help anyone stuck on the shellcode3 reversing engineering lab.
https://malwaretech.com/wiki/locating-modules-via-the-peb-x64

2025-06-06 18:48:51 UTC

Just released a new malware analysis lab! Shellcode3 tests your ability to analyze malicious shellcode and leverages a common technique used by malware to obscure API calls.
https://malwaretech.com/labs/shellcode/shellcode3

2025-06-05 08:44:51 UTC

As much as I don’t like Generative AI, it’d be beneficial for schools to teach students how to properly navigate it, rather than banning it. People are going to use AI regardless. Everyone needs to understand the limitations, or risk sacrificing critical thinking to something that can’t even think.

2025-06-05 08:03:11 UTC

- reply

@nprofile…u3t9 I gotta work :(

2025-06-05 07:09:54 UTC

#1 on my bucket list is to see a volcano erupt in person. I was in Hawaii during the May 25th Kilauea eruption, which I slept through. Now that I've left it's erupting again >_<
https://www.youtube.com/watch?v=BqmpkUdMtyA

2025-05-18 23:04:54 UTC

In the process of re-working and re-launching my beginner reverse engineering labs. You can test them out here: malwaretech.com/labs
More coming soon!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/531/335/732/085/826/original/cdd77a38799ef5a2.png

2025-05-12 22:06:25 UTC

- reply

@nprofile…2pe8 @nprofile…ngjg @nprofile…khad You can also replace SSL with smallpox. Not having a smallpox vaccine is unlikely to lead to smallpox, because the smallpox vaccine largely eradicated smallpox.

2025-05-12 22:05:18 UTC

- reply

@nprofile…kuw6 @nprofile…syfx No, they're one and the same. Overreliance on AI is an extremely reliable indicator that someone is dumb as fuck.