Lorenzo Franceschi-Bicchierai

Real-time cyber historian of the late capitalist era @TechCrunch, writing about the intersection of hackers, human rights, and spies.

Also writing a book about Hacking Team and the history of government spyware.

Posts about infosec, surveillance by day. 🍕, ⚽️, 🎸, 🎮 by night.  

☎️ Signal: +1 917 257 1382 
💻 Keybase/Telegram: @ lorenzofb 
✉️ [email protected] 

Previously: VICE Motherboard, Mashable, WIRED's Danger Room.

Public Key

npub1u76yrzs7y379urtp90prgsaj0a4wn9ru7fvcavrd8026ul0dj2ps8xgwu9

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsw0dzp3g0zglz7p4sjhs35gwe876hfj370ykvwkpknh4dw0hke9qcpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qwqlwdp

Publishing to

relay.ditto.pub

Author Public Key

npub1u76yrzs7y379urtp90prgsaj0a4wn9ru7fvcavrd8026ul0dj2ps8xgwu9

Show more details

Last Notes

2026-08-13 20:53:53 GMT

Apple is reportedly sending a new batch of notifications alerting targets of spyware.
If you have received one, we wrote a post on what to do next, and how to get help.
You can also contact me directly on Signal at +1 917 257 1382.
https://techcrunch.com/2025/12/29/youve-been-targeted-by-government-spyware-now-what/
See advice from Citizen Lab's John Scott-Railton here: https://x.com/jsrailton/status/2087978761207620071
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/090/183/623/814/837/original/2ec1abfdc6c522c6.png

2026-07-29 20:08:23 GMT

This is a great explainer of the OpenAI hack against Hugging Face, particularly of the report that the latter published earlier this week.
If you had trouble parsing the highly technical report, this article can walk you through it.
https://techcrunch.com/2026/07/29/the-hugging-face-ai-break-in-as-told-through-an-increasingly-committed-bear-metaphor/

2026-07-22 19:18:15 GMT

NEW: OpenAI said it built a “highly isolated” environment to test a model that then went rogue and autonomously hacked Hugging Face.
According to cybersecurity experts, the company made a human mistake—one expert called "a massive control failure"— that led to the unprecedented AI-enabled attack.
“This should never have happened,” said another expert. “If sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever."
https://techcrunch.com/2026/07/22/how-an-openais-human-mistake-led-to-the-ai-powered-hack-on-hugging-face/

2026-06-22 14:32:35 GMT

NEW: I took a look at the history of using export controls to limit the proliferation of cyber capabilities.
From the Crypto Wars of the 1990s to limit the spread of PGP, to the Wassenaar Arrangement to stop spyware flowing out of Europe, and now powerful AI models, I argue that this approach mostly does not work.
https://techcrunch.com/2026/06/19/encryption-spyware-and-now-mythos-history-shows-why-cyber-export-control-doesnt-work/

2026-06-03 19:30:40 GMT

Andy Boyd, the CEO of Red Lattice (the company that now owns spyware maker Paragon), went on the Risky Business podcast this week.
The host Patrick Gray asked Boyd about the contract that the company signed with ICE.
Here is the whole exchange. (starts at ~18:00)
https://www.youtube.com/watch?v=AOQETNsmTEU&t=1191s
—PATRICK:
Now we're actually on to something that is somewhat relevant to your day job, Andy, because we've got a story here from 404 Media where they are suing the US government, or they're suing ICE to get its spyware contract with Paragon.
I guess this is interesting for a couple reasons, right?
I understand that ICE is extremely unpopular in the United States, and in my opinion, quite reasonably so, given some of the stuff that they've been doing on the streets of the United States. They've earned some scrutiny, in my opinion.
*
*But I think also we've got to remember that Homeland Security Investigations is a division of ICE. So the idea that Homeland Security Investigations might want this sort of software is entirely reasonable.
*
*
So just reading from HSI's website, "It is the principal investigative component of DHS and is responsible for investigating, disrupting and dismantling transnational criminal organizations and terrorist networks that threaten or seek to exploit the customs and immigration laws of the United States."
*
*So if I had to bet, it would be dollars to donuts that that is the sort of use that, you know, HSI is using it for that sort of thing, not just deploying spyware onto the devices of people who are suspected of entering the United States without prior approval.
*
*Now, we have you here. So I figured I wanted to ask you about this report to see if you've got anything to say because we have had your company come out and make statements along the lines of, well, we don't actually have a relationship with ICE because that means, well, maybe a contract expired and then we've had now suspicions from other quarters of the media "Oh, well, perhaps they're accessing this technology through a third party."
We've got you here. Do you have anything you can share with us on this?
*
*
—BOYD
Yes, I guess I'm going to violate my rule of "I'm just a friend of Patrick." So for this one question.
Yes, as the CEO of Red Lattice, I'm not going to comment on specific customers, whether or not we have said specific customers.
But what I will say is that Red Lattice has a very specific policy on evaluating our customers before we sign any contract with them. This is something that is in the public domain.
*
*You Google the HSI writeup, our policies and how we go about evaluating potential customers. We only sell to liberal democracies, we only sell to countries that adhere to their rule of law. We sell to legitimate intelligence, military, and law enforcement authorities for conducting legitimate missions that fall under the laws of whatever country that may be in and that applies to the United States government as well.
*
*
—PATRICK
Yeah and I mean we should say too that this is a two million dollar contract which in the context of this industry is tiny. I mean can you say — would you acknowledge that?
*
*
—BOYD
I would acknowledge that any one of us, you, me, or James would be happy to have two million dollars at any time of day, but for a large company that may or may not be working with a government as big as the US government, that would be a fairly small contract, yes.
*
*
—PATRICK
Yeah, yeah. And I mean, I think we would point out too that there was some controversy around Paragon, the use of Paragon technology in Italy. I think where that ended up is you gave them the old heave-ho, didn't you?
*
*
—BOYD
Yeah, I'm not going to, again, that speaks to a very specific customer that is in the public domain. I think, Patrick, your inferences may be correct, but I'm not going to comment anymore on that one.

2026-06-01 18:37:54 GMT

NEW: Hackers were able to hijack several Instagram accounts by tricking Meta’s AI-powered support chatbot into resetting the victims’ passwords.
It’s unclear how many Instagram users were hacked due to this flaw. A Meta spokesperson said the issue has now been fixed.
https://techcrunch.com/2026/06/01/hackers-hijacked-instagram-accounts-by-tricking-meta-ai-support-chatbot-into-granting-access/

2026-05-20 15:31:25 GMT

NEW: Trump Mobile is leaking customers’ personal data, including email addresses and mailing addresses, according to two customers who have seen their own data.
The customers, two well known YouTubers, tried to contact Trump Mobile but have not heard back. They say the data is still exposed online.
https://techcrunch.com/2026/05/20/customers-say-trump-mobile-is-leaking-their-personal-information/

2026-05-18 14:04:03 GMT

- reply

@nprofile…pk8v OMG, I did not know this existed. I should try to get the hackingteam.it domain...

2026-05-06 18:24:52 GMT

🚨 HOT TAKE 🚨: I think nobody should ever ever ever use the expression "threat actor" except in technical reports or writeups designed to be read among industry insiders.
In news articles let's just use "hacker." I don't see a need to use the boring and for average people confusing "threat actor."

2026-04-27 16:36:23 GMT

I spoke with @nprofile…40zt for a 404 Media podcast about the zero-day industry, the incredible case of the L3Harris executive who leaked hacking tools to a Russian broker, and what happened to those hacking tools afterward.
Check it out here or on whatever podcast app you use.
https://www.404media.co/government-hacking-tools-are-now-in-criminals-hands-with-lorenzo-franceschi-bicchierai/

2026-04-22 19:36:25 GMT

NEW: The French government has disclosed a data breach at the agency that manages national IDs and passports.
Stolen data could include full names, dates and places of birth, mailing and email addresses, and phone numbers.
The number of affected individuals is unclear at this point.
https://techcrunch.com/2026/04/22/france-confirms-data-breach-at-government-agency-that-manages-citizens-ids/

2026-04-04 15:03:01 GMT

NEW: I spoke to cybersecurity legend Mikko Hyppönen about his decades-long fight against computers viruses first, and then malware — and how computers have gotten safer over time.
Mikko also told me why he has decided to now turn his focus to fight another enemy: killer drones. And, as it turns out, some of the technical challenges are very similar.
http://techcrunch.com/2026/04/04/after-fighting-malware-for-decades-this-cybersecurity-veteran-is-now-hacking-drones/

2026-04-02 15:43:46 GMT

- reply

You can read Lyons' full letter, which he sent to three Congresspeople, here: https://www.documentcloud.org/documents/27988741-ice-letter-response-to-congress/

2026-04-02 15:43:30 GMT

NEW: ICE confirms that it's planning to use Paragon's spyware to counter “foreign terrorist organizations’ thriving exploitation of encrypted communication platforms.”
ICE's acting director Todd Lyons said the agency will “comply with constitutional requirements,” without specifying what those are.
It's unclear if the agency’s criminal investigative unit Homeland Security Investigations (HSI) has already used the spyware.
http://techcrunch.com/2026/04/02/ice-says-it-bought-paragons-spyware-to-use-in-drug-trafficking-cases/

2026-04-01 16:38:11 GMT

NEW: WhatsApp alerted around 200 users that were tricked into installing a fake app that was actually government spyware.
The company accused Italian spyware maker SIO of being behind the app, and announced it plans to send the company "a formal legal demand to stop any such malicious activity."
http://techcrunch.com/2026/04/01/whatsapp-notifies-hundreds-of-users-who-installed-a-fake-app-that-was-actually-government-spyware/

2026-03-31 18:33:41 GMT

- reply

UPDATE: Google accused North Korean government hackers of being behind the supply chain attack against Axios.
“North Korean hackers have deep experience with supply chain attacks, which they’ve historically used to steal cryptocurrency. The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far reaching impacts,” said Google's John Hultquist.
https://techcrunch.com/2026/03/31/hacker-hijacks-axios-open-source-project-used-by-millions-to-push-malware/

2026-03-31 16:06:03 GMT

- reply

@nprofile…q9y9 I don't have the expertise to answer that question definitively. I heard that GrapheneOS is very good at security, so you may be fine with either. My gut instinct is to tell you to go with Apple because it's a much larger company with an elite security team. But maybe that's a reductive argument.

2026-03-31 16:03:50 GMT

- reply

@nprofile…trtw I have no idea how that happened

2026-03-31 16:03:01 GMT

NEW: Someone hijacked an open-source software development tool to push malware to millions of people.
The supply chain attack was stopped in less than three hours, but it's still unclear how many people got hacked.
https://techcrunch.com/2026/03/31/hacker-hijacks-axios-open-source-project-used-by-millions-to-push-malware/

2026-03-27 17:10:05 GMT

- reply

UPDATE: The FBI has confirmed the hack of director Kash Patel's personal gmail account, says the leaked data "is historical in nature and involves no government information."
https://techcrunch.com/2026/03/27/iranian-hackers-claim-breach-of-fbi-director-kash-patels-personal-email-account/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/302/242/319/339/844/original/ec54e14bfbad0522.png

2026-03-27 15:40:39 GMT

NEW: Iranian-linked hackers claim to have breached the personal Gmail account of FBI director Kash Patel, leaking emails and photos.
We were able to confirm that at least a portion of the emails are authentic.
The U.S. has accused Iran's government of being behind the hacking group Handala.
https://techcrunch.com/2026/03/27/iranian-hackers-claim-breach-of-fbi-director-kash-patels-personal-email-account/

2026-03-27 14:33:34 GMT

SCOOP: Apple says it's not aware of anyone using Lockdown Mode getting hacked with spyware, on all kinds of devices.
There have already been a couple of documented cases of Lockdown Mode stopping spyware attacks. And one case where an advanced hacking toolkit was designed to bail out if it detected Lockdown Mode on the target device.
If you're worried about spyware, you should use turn this security feature on.
https://techcrunch.com/2026/03/27/apple-says-no-one-using-lockdown-mode-has-been-hacked-with-spyware/

2026-03-26 20:02:44 GMT

- reply

I may have to post this on X unfortunately.

2026-03-26 19:59:18 GMT

Who is the Chaouki of the zero-day industry these days?

2026-03-26 17:24:48 GMT

NEW: We spoke to a few iPhone security experts about what the discovery of DarkSword means to the long-held assumption that iPhones are very hard to hack.
The answer is nuanced, and not simple. Apple has made significant strides in making iPhones more secure, but DarkSword may change how we think.
http://techcrunch.com/2026/03/26/apple-made-strides-with-ios-26-security-but-leaked-hacking-tools-still-leave-millions-exposed-to-spyware-attacks/

2026-03-26 15:00:48 GMT

Kaspersky has linked Coruna with Operation Triangulation. This somes a few weeks after we reported that L3Harris Trenchant was the company behind some components of Coruna.
And we also reported that it was possible Coruna was used in Operation Triangulation.
https://securelist.com/coruna-framework-updated-operation-triangulation-exploit/119228/

2026-03-26 15:00:48 GMT

- reply

A former Trenchant employee told us that when Triangulation was first revealed, other employees at the company believed that at least one of the zero-days caught by Kaspersky “were from us."
Also both Kaspersky and Trenchant seemed to wink at the fact that they both knew.
https://techcrunch.com/2026/03/10/us-military-contractor-likely-built-iphone-hacking-tools-used-by-russian-spies-in-ukraine/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/296/072/433/687/882/original/915e079300046aa8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/296/072/705/358/087/original/caa440df678be58c.png

2026-03-26 14:18:09 GMT

NEW: Here's everything you need to know about the new iPhone hacking tool DarkSword.
What is DarkSword? How does it work? Where did it come from? How did it leak online? What can you do about it?
We break it all down in this explainer.
http://techcrunch.com/2026/03/26/a-major-hacking-tool-has-leaked-online-putting-millions-of-iphones-at-risk-heres-what-you-need-to-know/

2026-03-25 16:40:01 GMT

NEW: Russian state media says police have arrested an unnamed person that's alleged to be the creator and founder of cybercrime forum LeakBase.
Europol, which shut down LeakBase earlier this month, said it did not cooperate with Russia on this arrest.
https://techcrunch.com/2026/03/25/russia-arrests-alleged-owner-of-cybercrime-forum-leakbase-report-says/

2026-03-23 20:46:42 GMT

SCOOP: Someone has found new samples of the iPhone spyware DarkSword and published them on GitHub, putting millions of iOS users at risk.
A cybersecurity researcher told us that the leaked spyware is "way too easy to repurpose" and "we need to expect criminals and others to start deploying this."
"The exploits will work out of the box," iVerify's Matthias Frielingsdorf said. "There is no iOS expertise required."
http://techcrunch.com/2026/03/23/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones/

2026-03-20 16:23:43 GMT

NEW: The U.S. accused Iran's government of being behind the hacktivist group Handala, which claimed responsibility for the destructive hack on medical tech giant Stryker.
The Justice Department said Handala and other fake hacktivist groups —including one allegedly behind the hack on the Albanian government in 2022 — are run by Iran’s Ministry of Intelligence and Security (MOIS).
http://techcrunch.com/2026/03/20/u-s-accuses-irans-government-of-operating-hacktivist-group-that-hacked-stryker/

2026-03-19 15:14:41 GMT

NEW: The FBI has taken down and seized two websites that were run by the pro-Iranian hacktivist group Handala.
“Law enforcement authorities determined this domain was used to conduct, facilitate, or support malicious cyber activities on behalf of, or in coordination with, a foreign state actor,” read the seizure notice.
The law enforcement actions comes a week after Handala claimed responsibility for the devastating hack of U.S. medical tech giant Stryker.
https://techcrunch.com/2026/03/19/fbi-seizes-pro-iranian-hacking-groups-websites-after-destructive-stryker-hack/

2026-03-13 15:00:08 GMT

NEW: The FBI is looking for a hacker who published several video games on Steam that were laced with malware in the last two years.
The bureau is aslo looking for gamers who fell victim and installed these games on their computers.
https://techcrunch.com/2026/03/13/valve-steam-malware-games-fbi/

2026-03-10 20:13:45 GMT

NEW: A former DOGE employee allegedly stole Americans' personal data from two large databases at the Social Security Administration, according to a new report.
The former employee allegedly put the databases on a thumb drive and wanted to use them at their new contractor job.
https://techcrunch.com/2026/03/10/doge-employee-stole-social-security-data-and-put-it-on-a-thumb-drive-report-says/

2026-03-10 02:03:17 GMT

SCOOP: The iPhone mass hacking toolkit used by Russian spies was developed at U.S. military contractor L3Harris, former employees said.
The Coruna toolkit was used against Ukrainians during the war and by Chinese cybercriminals, according to Google.
But the toolkit was initially developed for governments in the Five Eyes spy alliance, and it was used in Operation Triangulation, according to one source.
https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/

2026-03-10 00:49:34 GMT

I just learned that Trend Micro re-branded to TrendAI...uhm, OK.

2026-03-09 21:07:50 GMT

- reply

@nprofile…fwu9 seeya there

2026-03-09 20:16:08 GMT

- reply

@nprofile…fwu9 If you can calculate what year that is, sure

2026-03-09 20:14:40 GMT

If anyone is wondering, I will not be at RSA. And god willing I won't be at RSA next year either, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that, nor the year after that,

2026-03-09 15:58:45 GMT

NEW: Dutch intelligence services are warning of new Russian government-backed hacking campaigns against Signal and WhatsApp users, including government and military officials, and journalists worldwide.
The phishing and social engineering techniques used are not new, but the fact that the Dutch are warning against them means they work.
http://techcrunch.com/2026/03/09/russian-government-hackers-targeting-signal-and-whatsapp-users-dutch-spies-warn/

2026-03-05 20:42:38 GMT

NEW: Italian prosecutors confirm that the phone of journalist Francesco Cancellato was hacked with Paragon spyware at the same time as the phones of two immigration activists.
The Italian government admitted the hack on the activists, but said it wasn't behind Cancellato's hack.
So who was? The mystery continues, and Cancellato, as well as his colleague Ciro Pellegrino, who was also allegedly hacked, are demanding answers.
http://techcrunch.com/2026/03/05/italian-prosecutors-confirm-journalist-was-hacked-with-paragon-spyware/

2026-03-05 18:37:39 GMT

- reply

@nprofile…waj6 Good question...

2026-03-04 18:13:33 GMT

NSO Group has spent at least $7.6 million to lobby in Washington D.C., according to this report.
And it's gonna continue to pressure the U.S. government to get removed from the blocklist it was put on in 2021, in an attempt to get into the U.S. market.
NSO has hired a lot of people for its lobbying efforts.
https://www.techpolicy.press/will-nsos-us-lobbying-pay-off-under-trump/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/172/260/078/060/493/original/52cf0a2c5572751d.png

2026-03-04 17:08:21 GMT

This Google research on the Coruna iOS exploits is very interesting. And perhaps the most interestig things are all the open questions that are not answered here.
https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit

2026-03-03 17:43:08 GMT

NEW: There have been a few reports and some statements from government officials that suggest cyber operations played a significant role in the first days of the war in Iran.
At the end of the day this war is about dropping bombs, but these reports show cyber can have an important supporting role — for surveillance, intelligence gathering, disruption, and PYOPs — in real world conflict.
http://techcrunch.com/2026/03/03/hacked-traffic-cams-and-hijacked-tvs-how-cyber-operations-supported-the-war-against-iran/

2026-03-02 21:53:27 GMT

Does anyone remember what this self-spreading bluetooth malware for Nokia phones could have been? I got hacked with it 20 years ago and I never figured out what virus it was exactly.
https://www.vice.com/en/article/the-time-i-got-hacked-in-a-lisbon-bar/

2026-03-02 16:14:56 GMT

NEW: A group of hacktivist calling themselves "Department of Peace" claims to have hacked an office wihin the Department of Homeland Security.
The hacktivists leaked data on more than 6,000 contracts between DHS and ICE and private companies to the transparency website Distributed Denial of Secrets.
"The DHS is killing us and people deserve to know which companies support them and what they’re working on,” the hackers wrote in a manifesto.
http://techcrunch.com/2026/03/02/hacktivists-claim-to-have-hacked-homeland-security-to-release-ice-contract-data/

2026-02-26 19:40:07 GMT

This game security company estimates the video game cheating market to be worth 8.5 billion (yes, with a B). Absolutely wild.
https://www.intorqa.gg/post/cheatonomics-how-the-video-game-cheat-business-became-a-multi-billion-dollar-industry

2026-02-26 19:40:07 GMT

- reply

Reminds me of this profile of Cheat Ninja and its creator Catfish, who made cheats for PUBG Mobile, and made more than $75 million, according to Chinese police, which dismantled the organization and arrested some members.
Catfish, if you're out there, reach out. I'd love to know what you're up to.
https://www.vice.com/en/article/inside-the-worlds-largest-video-game-cheating-empire/

2026-02-26 15:47:05 GMT

NEW: A Greek court has ruled that Intellexa's founder Tal Dilian, and some associates, have to spend eight years in jail for wiretapping and privacy violations for their role in a spying campaign against politicians and journalists in the country.
There will be an appeal, and Dilian and the others will remain free until then.
https://techcrunch.com/2026/02/26/spyware-maker-sentenced-to-prison-in-greece-for-wiretapping-politicians-and-journalists/

2026-02-25 19:37:15 GMT

NEW: For months, I’ve been working on the story of Peter Williams, the former U.S. defense contractor who stole several hacking tools and then sold them to a Russian broker.
Now that Williams has been sentenced to seven years in prison, it's time to look back. Here’s what we know about the case, what we still don’t know, and a peek behind the scenes at how I reported this story.
http://techcrunch.com/2026/02/25/inside-the-story-of-the-us-defense-contractor-who-leaked-hacking-tools-to-russia/

2026-02-24 21:54:26 GMT

NEW: Former L3Harris boss Peter Williams was sentenced to seven years in prison for stealing sensitive company hacking tools, and then selling them to a Russian broker.
Williams, aka Doogie, previously pleaded guilty to stealing and selling eight trade secrets to Russian broker Operation Zero.
http://techcrunch.com/2026/02/24/former-l3harris-trenchant-boss-jailed-for-selling-hacking-tools-to-russian-broker/

2026-02-24 19:03:16 GMT

NEW: The U.S. government is sanctioning Russian zero-day broker Operation Zero and its founder, alleging it acquired stolen hacking tools from U.S. defense contractor L3Harris Trenchant.
The Treasury Department alleges former Trenchant boss Peter Williams stole and sold these exploits to Operation Zero, which then sold them on "to at least one unauthorized user."
https://techcrunch.com/2026/02/24/treasury-sanctions-russian-zero-day-broker-accused-of-buying-exploits-stolen-from-u-s-defense-contractor/

2026-02-19 22:11:27 GMT

NEW: Last year, Cellebrite stopped Serbia from using its tools after allegations that local police had abused them to hack into the phone of a journalist.
Now there are similar allegations in Kenya and Jordan, and Cellebrite is taking an entirely different approach.
http://techcrunch.com/2026/02/19/cellebrite-cut-off-serbia-citing-abuse-of-its-phone-unlocking-tools-why-not-others/

2026-02-19 15:36:58 GMT

- reply

UPDATE: Tenga spokesperson told us that after a forensic review, the company found that the breach affected "600 people in the US."
"We have already proactively contacted those who may have been impacted to ensure their safety and provide guidance," the spokesperson said.
https://techcrunch.com/2026/02/13/sex-toys-maker-tenga-says-hacker-stole-customer-information/

2026-02-13 20:23:07 GMT

NEW: A sex toy maker notified customers that it suffered a data breach where a hacker stole customer names, email addresses, and historical email correspondence, “which may include order details or customer service inquiries.”
The company, Tenga, is not saying how many customers are affected.
It's also unclear if this only includes data from U.S. customers, as the email notification we obtained came from Tenga Store USA, but the company is Japanese and sells in several countries.
https://techcrunch.com/2026/02/13/sex-toys-maker-tenga-says-hacker-stole-customer-information/

2026-02-09 16:28:35 GMT

NEW: A hacktivist scraped than half a million payment records from a stalkerware and consumer surveillance tech maker, exposing customers' email addresses and partial card numbers.
The hackvisit told us they did it because they think these companies are "creepy," and because they have fun "targeting apps that are used to spy on people."
https://techcrunch.com/2026/02/09/hacktivist-scrapes-over-500000-stalkerware-customers-payment-records/

2026-01-30 22:07:36 GMT

NEW: An informant told the FBI in 2017 that Jeffrey Epstein had a "personal hacker," according to a document released today.
The document does not name the hacker, but says he is Italian, developed and sold zero-days (iOS and Blackberry) to governments such as the U.K. and the United States, and even Hezbollah, which paid him with “a trunk of cash.”
https://techcrunch.com/2026/01/30/informant-told-fbi-that-jeffrey-epstein-had-a-personal-hacker/

2026-01-27 20:26:48 GMT

NEW: After Apple launched Lockdown Mode years ago, and Google released its own special security feature for Android last year, WhatsApp now offers a new mode for users at high risk of being targeted with spyware.
It's called Strict Account Settings and enables certain restrictions to protect users.
https://techcrunch.com/2026/01/27/whatsapp-is-rolling-out-a-new-stricter-security-setting-to-protect-users-from-cyber-attacts/

2026-01-23 17:50:18 GMT

Update to this. 25 days later, White Date is still down.
And Martha Root, the hacker, explained their motivations here, but not any technical details, which they promise are coming soon.
"No, this didn’t happen live on stage. And no it wasn’t a moment straight out of a hacker movie. It was mostly timing, a bit of performance and things that were already unfolding."
https://www.youtube.com/watch?v=lJsS8lqCpwU
https://elk.zone/infosec.exchange/@lorenzofb/115844030264996434

2026-01-23 16:37:44 GMT

- reply

@nprofile…9ynu :O I did not know that

2026-01-23 15:56:13 GMT

NEW: Microsoft handed the FBI the recovery keys to decrypt the hard drives of three laptops encrypted with BitLocker.
BitLocker is enabled by default in modern Windows laptops, but Microsoft also prompts users to upload the recovery keys to the company's cloud, which opens up this possibility.
http://techcrunch.com/2026/01/23/microsoft-gave-fbi-a-set-of-bitlocker-encryption-keys-to-unlock-suspects-laptops-reports/

2026-01-20 20:59:33 GMT

NEW: Two members of Elon Musk’s Department of Government Efficiency (DOGE) who were working at the Social Security Administration may have shared SSNs to help an advocacy group that had the aim "to find evidence of voter fraud and to overturn election results in certain States," according to a court document.
https://techcrunch.com/2026/01/20/trump-administration-admits-doge-may-have-misused-americans-social-security-data/

2026-01-08 19:19:03 GMT

NEW: NSO Group has released a transparency report that is even less transparent than its own previous transparency reports, as it contains no data or information on customers at all.
Experts say the report is just an attempt to appease and push the U.S. government to be removed from a blocklist.
The spyware maker did not respond to our questions asking it to share details on the customers that it has rejected, investigated, suspended, or terminated due to human rights abuses.
https://techcrunch.com/2026/01/08/critics-pan-spyware-maker-nsos-transparency-claims-amid-its-push-to-enter-us-market/

2026-01-08 18:37:02 GMT

NEW: The internet in Iran is nearly completely shut down, according to internet monitoring firms.
The blackout comes in the midst of countrywide protests that have lasted for days after spikes in prices and shortages of basic goods. The govenrment has responded with a violent crackdown.
“I think we’re at a near-total disconnection from the outside world now,” said Amir Rashidi, an Iranian cybersecurity researcher.
http://techcrunch.com/2026/01/08/internet-collapses-in-iran-amid-protests-over-economic-crisis/

2026-01-05 19:00:21 GMT

NEW: A hacktivist (@nprofile…d2df) dressed as Pink Ranger from the Power Rangers wiped three white supremacist websites on stage at the end of a talk at Chaos Communication Congress (39C3).
The hacker also published users’ data on the website okstupid.lol.
The three racist websites are still down, a week after the live hack.
http://techcrunch.com/2026/01/05/hacktivist-deletes-white-supremacist-websites-live-on-stage-during-hacker-conference/

2025-12-29 16:26:23 GMT

NEW: Apple, Google, and WhatsApp now regularly notify their users if they suspect they have been targeted or hacked with government spyware, such as that made by Intellexa, NSO Group, or Paragon.
Getting one of these can be scary, shocking, and confusing. So we spoke to experts and wrote a guide on what to do, and where to go, if you receive one of those notifications.
https://techcrunch.com/2025/12/29/youve-been-targeted-by-government-spyware-now-what/

2025-12-27 18:51:42 GMT

NEW: Meet the folks at AccessNow's Digital Security Helpline, who have been investigating government spyware abuses for more than a decade, helping journalists and dissidents all over the world.
Hassen Selmi, who heads the incident response team, told me his team looks into around 1,000 cases a year. Half of those turn into full investigations, and around 25 result in confirmed spyware infections.
Here’s how Selmi’s team fights spyware abuses.
https://techcrunch.com/2025/12/27/meet-the-team-that-investigates-when-journalists-and-activists-get-hacked-with-government-spyware/

2025-12-26 12:15:46 GMT

Out of curiosity, thinking that perhaps I missed something important or interesting, I searched for “Hacking Team” on YouTube and found this video.
I watched only 2 minutes, which are full of made up stuff presented as facts. Now I wonder if the script was AI generated. It has been 200k views.
https://www.youtube.com/watch?v=CJqwOHEY0Q8

2025-12-23 19:10:34 GMT

NEW: Hackers stole more than $2.7 billion in crypto last year, according to multiple blockchain monitoring companies.
North Korea alone stole 2 of those billions, thanks to the jackpot of the Bybit hack, which netted them $1.4 billion.
https://techcrunch.com/2025/12/23/hackers-stole-over-2-7-billion-in-crypto-in-2025-data-shows/

2025-12-23 17:15:33 GMT

NEW: U.S. insurance giant Aflac says its June data breach affected 22.6 million people.
The hackers, the company says, stole data such as Social Security numbers, government IDs, and health information.
https://techcrunch.com/2025/12/23/us-insurance-giant-aflac-says-hackers-stole-personal-data-of-22-6-million/

2025-12-23 17:08:56 GMT

What's up with all these "secret location" Barcelona offensive cybersecurity conferences?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/769/981/430/046/831/original/1d22d8ab9a16b532.png

2025-12-23 15:43:36 GMT

NEW: La Poste, France's postal and banking services company, hit by a suspected Distributed Denial of Service attack.
The postal service called the incident “a major network incident” that was disrupting “all of our information systems.”
https://techcrunch.com/2025/12/23/frances-postal-and-banking-services-disrupted-by-suspected-ddos-attack/

2025-12-19 20:15:30 GMT

NEW: Researchers say hundreds of Cisco customers are vulnerable to the newly revealed Chinese government-backed hacking campaign.
It appears the attacks right now “are targeted,” according to Shadowserver’s chief executive Piotr Kijewski. Censys for now only sees 220 exposed systems.
https://techcrunch.com/2025/12/19/hundreds-of-cisco-customers-are-vulnerable-to-new-chinese-hacking-campaign-researchers-say/

2025-12-19 15:48:07 GMT

- reply

It's objectively funny to see Ivan talk about how Apple secures its devices next to the logos of companies whose business models are to undermine the security of those devices, and help their customers hack those devices.

2025-12-19 15:33:37 GMT

Apple was very smart to send Ivan Krstić, who's been fighting spyware and exploit makers for years now, to Hexacon, a conference attended by a lot of spyware and exploit makers.
https://www.youtube.com/watch?v=Du8BbJg2Pj4

2025-12-19 14:49:16 GMT

As for every year, 2025 was a dumpster fire of data breaches, disruptive cyberattacks, and damaging hacks.
Here's our annaul look back at the worst cybersecurity incidents of the year.
https://techcrunch.com/2025/12/19/hacks-thefts-and-disruption-the-worst-data-breaches-of-2025/

2025-12-18 16:12:34 GMT

NEW: British healthcare technology provider DXS International, which sells to the National Health Service (NHS), disclosed a data breach today.
Earlier this week, ransomware gang DevMan took credit for hacking the company, claiming to have stolen 300 gigabytes.
http://techcrunch.com/2025/12/18/tech-provider-for-nhs-england-confirms-data-breach/

2025-12-17 19:10:43 GMT

Please keep me posted if you see or hear something about this.

2025-12-17 19:00:27 GMT

NEW: Cisco discovered a Chinese hacking campaign targeting an unknown number of customers.
The hackers have been exploiting a zero-day in some of Cisco's most popular products "since at least late November 2025."
There is no patch available at this point.
https://techcrunch.com/2025/12/17/cisco-says-chinese-hackers-are-exploiting-its-customers-with-a-new-zero-day/

2025-12-16 15:42:47 GMT

NEW: Hacking group Scattered Lapsus$ Hunters says it's trying to extort Pornhub after stealing Premium users's data.
The data reportedly includes the registered email addresses and location; activity type, such as which videos and channels they watched, including the video name and web address.
http://techcrunch.com/2025/12/16/hacking-group-says-its-extorting-pornhub-after-stealing-users-viewing-data/

2025-12-12 20:46:42 GMT

NEW: Google and Apple have fixed zero-days that the two companies said were being exploited in the wild.
There are no details about these attacks, but usually when this happens, there's a goverment using spyware behind it. Hopefully we will get the full story soon.
http://techcrunch.com/2025/12/12/google-and-apple-roll-out-emergency-security-updates-after-zero-day-attacks/

2025-12-12 15:39:19 GMT

NEW: A flaw in the website of Hama Film, a photo booth maker with presence in Australia, UAE and the U.S., exposes pictures and videos of its customers.
Security researcher alerte the company, no answer. We reached out to the company, no answer.
https://techcrunch.com/2025/12/12/flaw-in-photo-booth-makers-website-exposes-customers-pictures/

2025-12-11 14:36:49 GMT

NEW: Right-wing messaging app Freedom Chat had security flaws that allowed a researcher to guess all numbers registered on the platform, and one that exposed user PINs to other users.
The researcher enumerated around 2,000 phone numbers.
https://techcrunch.com/2025/12/11/security-flaws-in-freedom-chat-app-exposed-users-phone-numbers-and-pins/

2025-12-10 18:08:57 GMT

- reply

@nprofile…z8qc Interesting, I did not think of that!

2025-12-10 17:42:51 GMT

- reply

@nprofile…tyyn Nation states, let me clarify in post

2025-12-10 17:27:42 GMT

Serious question: if you get a threat notification from Apple, WhatsApp, Google...and you are not a journalist ot dissident so you can't go to Citizen Lab/Amnesty/AccessNow, where do you go?
Asking for an article, not for someone who's gotten that notification.

2025-12-09 15:43:37 GMT

- reply

And Haaretz also had a good story on the flow of Israeli offensive cybersecurity workers to Barcelona.
https://www.haaretz.com/israel-news/security-aviation/2024-12-26/ty-article/.premium/israeli-hackers-flock-to-barcelona-as-spyware-industry-shifts/00000193-fec4-df5b-a9b3-fec5d9dc0000

2025-12-09 15:42:39 GMT

- reply

If you’re wondering about the offensive cybersecurity and spyware scene in Barcelona, I wrote a deep dive into it last year.
https://techcrunch.com/2025/01/13/how-barcelona-became-an-unlikely-hub-for-spyware-startups/

2025-12-09 15:42:15 GMT

There's a new offensive cybersecurity conference in Barcelona. The tagline: "Sun, seafood, and spyware."
That rings a bell...🤔
https://offensive-bcn.com/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/690/368/692/739/087/original/1302e40292f930cc.png

2025-12-08 22:53:04 GMT

NEW: The FTC denied a request from serial spyware maker Scott Zuckerman to be unbanned from the surveillance industry.
Zuckerman used to run the stalkerware app SpyFone, which in 2018 exposed extremely sensitive data of both its customers and the people they were spying on.
That leak, which exposed selfies, text messages, chat app messages, audio recordings, contacts, location, hashed passwords and logins, and more, was the reason for the FTC ban.
https://techcrunch.com/2025/12/08/ftc-upholds-ban-on-stalkerware-founder-scott-zuckerman/

2025-12-08 17:10:26 GMT

NEW: Petco's data breach exposed customers' Social Security numbers, driver’s license numbers, financial information, and more.
The company is still not saying how many customers in total were affected by this security incident.
https://techcrunch.com/2025/12/08/petcos-security-lapse-affected-customers-ssns-drivers-licenses-and-more/

2025-12-05 16:25:53 GMT

After we published this story, Kohler has removed all mentions of "end-to-end encryption" from its website.
Company PR said: "We used the term with respect to the encryption of data between our users (sender) and Kohler Health (recipient)."
https://elk.zone/infosec.exchange/@lorenzofb/115657404842921725

2025-12-05 14:53:38 GMT

NEW: Pet products and services giant Petco has disclosed a data breach, but it is not saying how many people were affected, nor what personal data was exposed.
Spokesperson said company had “provided further information to individuals whose information was involved.”
http://techcrunch.com/2025/12/05/petco-confirms-security-lapse-exposed-customers-personal-data/

2025-12-04 18:59:40 GMT

- reply

You should absolutely read this Haaretz story on the leaks, which covers a lot of ground.
https://www.haaretz.com/israel-news/security-aviation/2025-12-04/ty-article-magazine/.premium/israeli-spyware-firm-intellexa-owned-by-ex-intel-officer-still-active-amid-us-sanctions/0000019a-e3e8-db35-afbf-ebfcb8bb0000

2025-12-04 18:17:59 GMT

NEW: Staffers at notorious spyware maker Intellexa had live remote access to their customers' surveillance systems.
This allowed them to see the personal data of targets hacked with Intellexa's spyware Predator, according to new research based on a leaked training video.
Needless to say, this is bad for several reasons.
http://techcrunch.com/2025/12/04/sanctioned-spyware-maker-intellexa-had-direct-access-to-government-espionage-victims-researchers-say/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/662/668/250/729/964/original/4707dafe13bac2a6.jpeg

2025-12-03 19:59:03 GMT

NEW: Your "end-to-end encrypted" poop pictures taken by this $599 (+ subscription) smart toilet camera are actually not end-to-end encrypted.
¯_(ツ)_/¯
https://techcrunch.com/2025/12/03/end-to-end-encrypted-smart-toilet-camera-is-not-actually-end-to-end-encrypted/

2025-12-01 18:42:49 GMT

NEW: Europol shut down Cryptomixer, a crypto service alleged to have facilitated the laundering of 1.3 billion euros since 2016.
Service was allegedly used by cybercriminals, drug and weapons traffickers, and ransomware gangs.
https://techcrunch.com/2025/12/01/european-cops-shut-down-crypto-mixing-website-that-helped-launder-1-3-billion-euros/

2025-11-26 16:17:16 GMT

NEW: A trivial-to-exploit bug in jury systems used across the United States was exposing jurors' sensitive personal data, such as full names, date of birth, occupation, email addresses, cell phone numbers, and home addresses — and potentially even health data.
The bug essentially allowed anyone to brute-force and access jurors' accounts.
The system is provided by gov tech gian Tyler Technologies. We alerted them of the bug on Nov. 5, they acknowledged and said they fixed it yesterday. ** **
https://techcrunch.com/2025/11/26/bug-in-jury-systems-used-by-several-us-states-exposed-sensitive-personal-data/

2025-11-21 18:35:52 GMT

NEW: Google says the new wave of supply chain attacks by Scattered Lapsus$ Hunters impacted more than 200 companies' Salesforce-stored data.
This wave of breaches of Gainsight customers was caused by a previous breach at Salesloft Drift, ShinyHunters told us.
Hackers said they breached Atlassian, CrowdStrike, Docusign, F5, Gitlab, Linkedin, Malwarebytes, Sonicwall, Thomson Reuters, Verizon.
Malwarebytes said it is investigating.
CrowdStrike said company is "not affected."
https://techcrunch.com/2025/11/21/google-says-hackers-stole-data-from-200-companies-following-gainsight-breach/