Marcus Hutchins :verified:

Cybersecurity

Website: https://marcushutchins.com
Security Blog: https://malwaretech.com

Public Key

npub1uu7gddsfwccptfz3wgqqgxz0wuwx302e07k3u475he6qzasfkz4q0hgs7t

NIP-05 Address

malwaretech_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsww0yxkcyhvvq453ghyqqyrp8hw8rgh4vhltg72l2tuaqpwcymp2sprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyv8wumn8ghj7un9d3shjtnndehhyapwwdhkx6tpdsc6klm0

Publishing to

relay.momostr.pink

relay.snort.social

nostr.mom

Author Public Key

npub1uu7gddsfwccptfz3wgqqgxz0wuwx302e07k3u475he6qzasfkz4q0hgs7t

Show more details

Last Notes

2026-07-22 21:44:21 UTC

My take on the story about OpenAI's model going rogue and hacking a competitor's systems, why it matters.
Also probably the fastest turnaround time for a video that I've managed so far. I'd just got off a 12h flight when the story dropped.
https://youtu.be/GB8gaeI0fLs?si=ss3hD78xG2XUREYn

2026-05-23 19:57:17 UTC

Slowly setting up my video/livestream studio again. The amount of tech required for even a half decent experience is crazy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/625/652/354/646/999/original/8e9df7a1f80504b4.png

2026-05-07 18:36:32 UTC

I found a zero day in a security vendor's firewall software that allows you to remotely crash the entire system by sending it a single malicious packet. Since the firewall is responsible for inspecting traffic prior to the operating system handling it, no ports even need to be open for it to work.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/738/287/375/008/original/2eb9415580efecdf.mp4

2026-05-05 05:24:43 UTC

I built an AI that autonomously finds zero day exploits https://www.youtube.com/watch?v=BLqRiL_GY3A

2026-03-18 23:53:59 UTC

After years of planning a potential collab, I finally got to sit down with fellow cybersecurity YouTuber David Bombal for an in person interview! Below you can check out the video from what will hopefully be the first of many more collaborations 😃 :
https://www.youtube.com/watch?v=KsXzTz5H2QQ

2026-03-08 22:29:52 UTC

It feels like Proton are being intentionally misleading in their statements. They know that most of their customers aren't familiar with how legal process actually works, so are happy to spread half-truths.
Under US law, a US law enforcement agency (LEA) typically has to apply for a subpoena or search warrant with a US court. The court is then responsible for deciding if the legal bar for search a request has been met, then either grants or denies it.
The problem is, if a company has no real US footprint (no US corporate entity, offices, servers, etc.), then a US court typically doesn't have the jurisdiction to compel the company to hand over customer data (except in some rare circumstances). Even if the court approved the warrant anyway, it wouldn't really be legally binding.
Which is why the Mutual Legal Assistance Treaty (MLAT) exists. MLAT enables law enforcement agencies in one company to send requests for information to law enforcement agencies in another. Switzerland has such a treaty with the US. This means that the FBI can request that Swiss authorities hand over a Swiss company's data on their behalf.
Any country requesting information held by a company in a foreign jurisdiction would typically do so via MLAT. Which means from Proton's perspective, the legal request would appear to originate from their local law enforcement, not the FBI. Which they clearly understand based on their Reddit post.
Saying "we don't respond to legal requests from anywhere other than Swiss authorities" seems very intentionally worded to give the impression that the company does not cooperate with foreign law enforcement. But since it'd be the Swiss authorities handling any such requests, they'd have to comply, since as they admitted, they have to comply with local laws.
There is, however, some useful (but more nuanced) information here:
Firstly, MLAT requests are handled by local law enforcement according to local law. So if there is a difference between the law of the sending and recipient country, that might mean the MLAT request is denied. That probably doesn't mean much, because if you're on the FBI's radar, the chances are you did something that is also massively illegal in Switzerland too.
Secondly, they are 100% correct in saying that no other service provider is going to do any better. They're all beholden to local laws, and the ones that think they're not tend to get their doors blown off by SWAT like CyberBunker did. The only exception is if the company resides in a country which does not cooperate with US law enforcement (which Proton does not).
But the part that's extremely disingenuous is that the "we only respond to requests from the Swiss authorities". That statement is likely intended to imply they don't cooperate with law enforcement in any other countries, which is simply not true. Switzerland has MLAT agreements with over 30 counties.
People really need to understand that no company is going to shield you from the FBI (or any reputable law enforcement agency). They'll use misleading statements to make it sounds like they don't cooperate with law enforcement, but they do. They have to.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/195/916/812/004/684/original/c9b267c29540586b.png

2026-02-25 06:09:07 UTC

We plan to decrease operational costs for our AI model by building custom servers that are immune to cosmic radiation, then spending trillions of dollars launching them into space. Yes, our CFO did tech themselves math using ChatGPT, why do you ask?

2026-02-24 20:52:06 UTC

Anthropic when Chinese companies use Claude to train their own AI models vs Anothropic when they’re stealing everyone’s data to train Claude
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/127/585/108/948/125/original/f474ce1657d0aa13.jpeg

2026-02-08 20:59:15 UTC

When the state sponsored threat actor has vibe coded their entire control server, all the login code is client-side, and they’ve infected themselves with their own malware.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/037/016/208/070/006/original/211e71447c96776e.jpeg

2026-02-03 05:01:56 UTC

I can’t believe we’re doing this again. It’s just a bot that generates the text you ask it for. If you put it in charge of critical decisions, it will kill people. Not because it’s secretly evil, but because it’s a word generator. It’s like putting your toaster in charge of air traffic control.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/004/940/386/328/628/original/7d05413e7c3f2ac8.jpeg

2026-01-20 21:14:51 UTC

My latest blog post investigating a malware campaign which infects victims by utilizing only legitimate infrastructure. The malicious activity spans hundreds of hacked websites, the BSC blockchain, and a popular CDN.
https://expel.com/blog/clearfake-new-lotl-techniques/

2025-12-27 18:08:11 UTC

One concern about the AI bubble that I've not yet seen discussed is how many All-In podcasts it's going to create. Every time one of these AI companies is bought or IPOs, it creates like 10 new billionaire who will start a podcast where they pass their single brain cell around a table and influence people on issues they know nothing about.
Remember when David Sacks and Jason Calacanis got together with Elon Musk and tried to sabotage Ukraine's defense because they convinced themselves that angering Russia would lead to a nuclear war? Now imagine there's 400 of them. At this rate the entire media sphere will just be midwit billionaires with podcasts.

2025-12-15 17:38:26 UTC

The tariffs certainly appear to be working. American companies are no longer importing goods from China. Instead, they're becoming Chinese companies and producing good domestically.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/724/799/528/162/680/original/d2f4f8a00ab0abb7.png

2025-12-11 19:59:28 UTC

Is it me or are major internet platform outages getting more frequent? I used to instinctively reboot my router, now I just assume it's the platform. GitHub broke for me this morning, now LinkedIn is offline. Reddit and Twitter feel like they go down twice a week. Meanwhile all these companies are bragging about layoffs because they've "become more efficient with AI". Like, dawg, you can't even keep your website online.

2025-11-28 20:20:29 UTC

Here's an easy way to understand the US "hacking back" / Offensive cyber operations proposal: You lose the keys to your house down the back of the couch. It would be very time consuming to try and dig them out, but buying new locks would cost money.
The least expensive option is to simply remove the entire front door, which your family approves of. This would leave more money to gamble in the slot machine (some guy who says he is 100% definitely not the owner of the slot machine has told you that if you put in enough money, you will receive a return on your investment).
After voting to remove the front door, someone walks into your house and steals your TV. Having to buy a new door, new locks, and new TV would cut into the slot machine fund. Which is unacceptable.
You decide the most cost efficient option is to track down every thief in the world and punch them in the face. The family agrees that punching every thief in the face would certainly deter any further theft, and have absolutely no possible negative consequences at all.
The not slot machine guy has also offered to buy all your house's windows for $30, to help you recuperate some of the losses from your TV being stolen. You agree that this is indeed a good deal, and proceed to remove every window.
One day you come come to find a 600 pound grizzly bear rooting around in your pantry eating all your food. Your are completely perplexed. Despite your best efforts to secure your home against theft, people have still been walking in and taking whatever they want. However, a grizzly bear is new.
You consult with the not slot machine guy, who has recently used all his not slot machine money to buy up every local hospital. You are concerned that the punching everyone in the face policy does not appear to have affected theft rates. Also, this policy was designed for humans, not bears.
The not slot machine guy reassures you that this is the best way. He tells you that you just aren't punching people hard enough. He also says that there is no reason why the same policy couldn't also be applied to bears. He sells you some punching classes for $5 trillion dollars and send you on your way.
With your new found punching skills, you are now ready to fight the bear. You return home to find out that all of the local bears have learned that your pantry is a great place to get food. There in now an entire group of them. That is ok though, you've been training for this.

2025-11-17 04:57:28 UTC

Do You Need To Worry About China's Agentic AI Cyberattacks?
https://www.youtube.com/watch?v=siZaZf3lK_8

2025-10-30 16:27:51 UTC

Watch OpenAI go public and just follow Tesla's business model (convincing retail investors to shovel their money into a fire while announcing "AGI is coming next year" every year forever).

2025-10-25 01:45:39 UTC

Absolutely incredible stuff coming out of Bozo The Clown School of Economics.
1. convince everyone you're going to fix the economy by slapping tariffs on everything.
2. Tell Americans that other countries will pay the tariffs, even though tariffs are paid by importers (you).
3. Americans gets mad when beef prices go up because as it turns out, importers do in fact pay the tariffs.
4. That's ok, the tariffs were really about rewarding companies who produce goods locally, so at least the American farmers are happy.
5. Wait, never mind. Other countries have started importing beef from elsewhere because US beef is too expensive now.
7. Don't worry though, it's all part of the plan. We will fix this by simply giving $20 billion dollars of taxpayer money to Argentina.
8. Ok, that didn't seem to have worked. Maybe if we announce we're going to give them $40 billion dollars instead?
9. Hmmm, bailing out Argentina doesn't seem to have fixed the US economy.
10. Lower Argentina's beef import tax rate to less than it was before you got into office, costing US farmers even more money.
11. Somehow all of this is actually good and part of a completely sane economic policy, I'm just too dumb to understand the grand plan.
MAGA - Make Argentina Great Again?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/432/274/878/019/634/original/551dacad58e4c810.png

2025-10-24 20:09:56 UTC

Did you know that you can passively download malicious payloads onto target systems?
Lots of software caches images locally to save bandwidth, often without stripping metadata.
You can leverage this functionality to download payloads.
Simply store your payload inside a valid image, then just have the target's web browser or email client download it for you.
No more web requests to obtain follow-up payloads!
https://malwaretech.com/2025/10/exif-smuggling.html?a=1

2025-10-03 23:04:35 UTC

Looks like the 3rd party platform Discord uses for support tickets got breached and someone was able to gain access to Discord user information as well as trust & safety reports
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/312/733/307/736/834/original/53d654fc338cb929.png

2025-07-28 17:08:37 UTC

In the interest of both being an AI hater and doing things purely for content, I've signed ChatGPT up for a brokerage account and given it several thousand dollars to trade with. Will report back with how it goes.

2025-07-26 04:47:20 UTC

Not really buying this claim from Tea. I'm not aware of any laws which require platforms to retain raw identification documents, especially not for "cyberbullying prevention". Some laws require retention of user metadata like IP addresses, but retaining photos of government IDs used for ID verification is just plain reckless.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/917/719/333/469/528/original/9407b42d0d9e6ed6.png

2025-07-23 20:15:39 UTC

This is what it's like publishing research in 2025. I write an extremely popular blog post on EDR bypasses and Google just comes along and steals my search traffic in the most brazen way possible.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/904/382/725/891/160/original/cce7dbee3382637d.png

2025-07-11 05:45:21 UTC

A programming fact that still amazes me is that the HTTP header which containers the referring url is called "referer", because the developer spelt "referrer" wrong and the spell checker didn't catch it, so it made it into the official standards and they just never changed it lmao

2025-07-11 04:46:42 UTC

I've changed my mind about AI. I now believe it will be able to replace programmers. I asked Grok a question and it responded by forgetting how to use its own API, spending 3 minutes trying to read the documentation in-between failed attempts at getting it to work, then just gave up entirely. It's just like me fr.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/832/782/221/290/392/original/36d39acc4ea9f424.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/832/782/222/258/645/original/09d703ed22d1d1b3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/832/782/219/589/011/original/de2ef6e1527926a0.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/832/782/221/320/499/original/35d1c9dd27d997c2.png

2025-07-02 18:46:02 UTC

Yet more companies laying off employees not because AI is replacing them, but because they need more money to fund their AI. I can't remember the last time I saw sunk cost fallacy at this scale.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/785/121/832/072/782/original/a3e5d8c6daff454d.png

2025-06-27 17:23:32 UTC

Useful threat intelligence signal: deploy honeypots to your network then filter out any traffic that matches public databases of known malicious IPs. Malicious traffic hitting your network is interesting, but what's hitting your network that isn't hitting everyone else's is much more so.

2025-05-12 10:03:11 UTC

As much as I love the job security, someone is going to have to stop these AI bros before they have us watering the crops with Brawndo.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/494/287/618/576/384/original/99fe46b2fe5c3613.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/494/287/734/645/542/original/ade27f87a960ba4a.png

2025-05-06 20:48:01 UTC

After 7 years of external circumstances getting in the way, I finally managed to sit down with @npub1j70…q6fl and record a Darknet Diaries episode. Check it out here! :D
https://darknetdiaries.com/episode/158/

2025-04-10 03:12:39 UTC

Just woke up to find out the president has revoked the security clearances of everyone at a cybersecurity company because Chris Krebs went to work there. Krebs was his director for the agency in charge of Cybersecurity & Election Security during his first term and refuted his claim the 2020 election was "stolen".
Revoking the clearance of every employee basically kills the company's ability to do government contracts, which is a major source of revenue for cybersecurity companies. The White House press release also restates the false claim that the 2020 election was "rigged and stolen".
The US is basically a fascist dictatorship at this point. One where the president goes after entire companies because a single person spoke out against his verifiably false claims. You'd have to be completely insane to travel here right now.

2025-04-08 18:04:21 UTC

What Is Fast Flux And Why Is The NSA Calling It A National Security Threat?
https://www.youtube.com/watch?v=CQ3nnlZ8nbw

2025-04-08 06:42:18 UTC

I bought $200 worth of stuff from Costco this week and they bought $0 worth of stuff from me. To resolve this deficit I will be charging myself $50 every time I go to the store. With this extra income I will build toasters, which I will attempt to sell to my local Costco for $200 each.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/300/978/517/719/702/original/b6a96a1f935d1746.png

2025-02-16 07:53:49 UTC

Really great thread on Bluesky by @npub1wym…dmr0 about the disparity between economic indicators and voter's actual lived experience.
https://bsky.app/profile/tarah.org/post/3liaxh3vjyk23

2025-02-12 09:14:10 UTC

- reply

When someone is comfortable with making posts supporting the AfD, defending a Nazi salute, and mocking trans people & DEI from their professional account under their real name, you can only wonder what they do in private. I'm certainly not comfortable sharing a space with someone like that, and I'm sure many others aren't either.

2025-02-09 06:15:39 UTC

Oh man, I have so many stories about the "startup" (Path Network), which the 19-year-old DOGE employee, Edward Coristine previously worked for.
https://www.wired.com/story/edward-coristine-tesla-sexy-path-networks-doge/
My first interaction with the founder, Marshal Webb, was in 2016 when the company was called "BackConnect'. I'd recently posted a research paper on the Mirai botnet, which lead to him harassing me online, simply because he considered himself to be the sole authority on Mirai.
It later turned out, that a lot of his knowledge came from the fact that he was personally hosting the threat actors' infrastructure, therefore had direct insight into the botnet. He tried to play it off as an "intelligence gathering operation". Everyone knew he was really just in bed with the threat actors, but nobody could prove it enough to make a case against him.
At some point shortly after, a DDoS-for-hire service got hacked and its entire customer database along with all DDoS attack logs was leaked online. One of the records traced back to an employee of his DDoS mitigation firm, and from a combination of attack logs and corroboration with customers, it was determined that they had been launching DDoS attacks against businesses, then cold calling them to sell DDoS protection services.
It was fairly apparent from the fact the emails coincided with the DDoS attacks, but did not originate from the the employee performing the attacks that the company was in on it, and this wasn't the work of some rogue employee. Nevertheless, said employee got thrown under the bus, convicted, and was unsuccessful in proving that his employer was in on the conspiracy, although they most certainly were.
Eventually, the founder ended up being named in some kind of criminal complaint or other FBI related court document. The specific wording seemed to imply that he'd gotten caught doing something illegal enough that he'd become an informant to save himself. Amusingly, when the document surfaced, the company just issued a press release about how they were "helping the FBI stop crime" and nothing become of it.
The company has always been shady as hell, and while it's not abnormal for cybersecurity firms to hire reformed hackers, I've not seen a single employee who was not directly involved in cybercrime immediately prior to getting hired. Furthermore, multiple of the employees have been caught committing cybercrime while working for the company.
Originally, when I posted this thread on February 6th, I stopped short of any allegation that Edward himself was involved in cybercrime. Since then @npub1vc3…axsh was able to trace his aliases back to a known cybercrime organization and confirm he indeed was directly involved in cybercrime as recently as May 2024.
You can find Brian's Mastodon thread on the matter here:
https://infosec.exchange/@briankrebs/113965646509637016
https://infosec.exchange/@briankrebs/113957683483583881
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/972/460/071/311/426/original/ac0158c98b850633.png

2025-02-03 04:47:19 UTC

Why I think AI guardrails designed to stop cyber criminals from abusing LLM to generate things like malware and phishing emails are essentially useless security theater.
https://www.youtube.com/watch?v=dLOpEPENwF0

2025-01-24 10:49:55 UTC

I went back to the Nerd Reich website to see who in infosec was defending the Nazi salute, and wasn't super surprised to see Florian Roth. He's spent the last few months posting pro-AfD (German Neo-Nazi party) propaganda and interacting with AfD accounts in his replies. Just a heads up for those of you who work with him.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/882/933/230/089/903/original/9ff8cb89692f1cea.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/882/933/478/437/157/original/e7c434d7e6e030ab.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/882/933/948/039/072/original/2af9ed5bce41f452.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/882/949/223/907/168/original/7958046eef66eab3.png

2025-01-09 04:56:13 UTC

Why You Probably Don't Need A VPN To Stay Secure On Public Wi-Fi
You've probably heard advice about how hackers can steal all your sensitive information if you don't use a VPN on public Wi-Fi, but is that actually true? In this video I'll walk through some of the major risks of public Wi-Fi such as Man-In-The-Middle Attacks, Rogue Access Points, SSL Stripping, and TLS Downgrades, as well as discuss how modern security measures prevent them.
https://www.youtube.com/watch?v=i7GwjGGwxzg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/796/616/858/522/154/original/73b33f85b5ef4dc6.jpeg

2024-12-16 22:25:28 UTC

Learn a new language? No thanks, I already work in cybersecurity.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/664/847/206/026/486/original/6bc716eeafac37ff.png

2024-11-30 06:31:52 UTC

Thank god my warranty is ok
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/570/497/101/318/643/original/c3ffb0a6d7b9cf63.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/570/497/363/147/165/original/a2d6fdf7daba2b68.png

2024-11-19 22:35:00 UTC

- reply

Paying $400 for a game is actually insane lol

2024-11-10 20:31:52 UTC

I just saw an FBI agent in the wild wearing one of those jackets that says FBI in big yellow letters and realized I've never once seen one before. I was starting to think it was a Hollywood trope 😆

2024-11-10 16:31:59 UTC

I'm hoping Trump wins the popular vote purely because we really really need to skip the months or years of arguing X or Y state should do a recount, the electoral college should be abolished, the election was stolen, or any other pointless straw grasping & denialism. Every minute spent on that is a minute spent not helping the people whose safety is at risk.

2024-11-07 15:45:46 UTC

I can tell I'm in a social media bubble because everyone on most of the platforms I'm on is being reasonable despite being sad/scared.
Then I go over to Threads and my feed is entirely just left wing voters beating the shit out of each other. They're going after people who voted independent, people protesting genocide, and somehow even Obama is taking strays. I want to say it's bots designed to increase division, but honestly, deep down we all know it's not.

2024-11-06 21:03:36 UTC

- reply

Quitting was a ridiculously hard decision to make. They gave me the option to transfer to the new company and get founder shares in the process. The new product was honestly one of the coolest things I've seen in a long time, and way better than what I was working on. But having just committed 9 years of my life to nothing, it's kind of hard to again stake my future on a startup, knowing that all matter of things could go wrong.

2024-11-06 20:46:59 UTC

I genuinely though this was gonna be a good year lol. Federal case over, covid mostly over, perfect time to start putting my life back together.
The year starts off with the company that acqui-hired me deciding they want to pursue a different business and disbanding the product we spent 9 years building, vaporizing the majority of my net worth in the process. Then things kinda just kept going downhill from there.
I get the whole "what doesn't kill you only makes you stronger" but I don't have any plans to fight god.

2024-11-06 17:08:02 UTC

- reply

Only thing that really springs to mind is this old video from the Indian philosopher Osho
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/437/098/307/442/723/original/5c8f549fcad009bc.mp4

2024-11-06 17:03:28 UTC

As bad as I thought the election was going to go, that went so much worse. It wasn't even lightly Trump, it was full on just "yes daddy, please fist me"