Lorenzo Franceschi-Bicchierai

Real-time cyber historian of the late capitalist era @TechCrunch, writing about the intersection of hackers, human rights, and spies.

Also writing a book about Hacking Team and the history of government spyware.

Posts about infosec, surveillance by day. 🍕, ⚽️, 🎸, 🎮 by night.  

☎️ Signal: +1 917 257 1382 
💻 Keybase/Telegram: @ lorenzofb 
✉️ [email protected] 

Previously: VICE Motherboard, Mashable, WIRED's Danger Room.

Twitter: https://twitter.com/lorenzofb
Personal Site: https://lorenzofb.com
Pronouns: He/him
Searchable via: tootfinder
TechCrunch: https://techcrunch.com/author/lorenzo-franceschi-bicchierai/

Public Key

npub1xvwy4g0lns9cn5s8rjnc6xm2adfjumtl3rgek5wndcpmtshsk9lsq0ksg7

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsrx8z258leczuf6gr3efudrd4wk5ewd4lc35vm28fkuqa4ctctzlcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dskmtqky

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1xvwy4g0lns9cn5s8rjnc6xm2adfjumtl3rgek5wndcpmtshsk9lsq0ksg7

Show more details

Last Notes

2026-06-11 16:32:42 UTC

If you're bored, this website shows you random exposed webcams all over the world. https://stumbletv.alec.is/c/38c16f28687f1a55

2026-04-27 16:36:23 UTC

I spoke with @npub1n2y…qlcl for a 404 Media podcast about the zero-day industry, the incredible case of the L3Harris executive who leaked hacking tools to a Russian broker, and what happened to those hacking tools afterward.
Check it out here or on whatever podcast app you use.
https://www.404media.co/government-hacking-tools-are-now-in-criminals-hands-with-lorenzo-franceschi-bicchierai/

2026-04-24 14:21:35 UTC

NEW: Researchers have have exposed yet another spyware maker that makes fake Android apps for its government customers. The apps were pushed with help of telecom providers.
And it's yet another Italian company: IPS. Until now, IPS was only known to make traditional wiretapping surveillance systems.
The researchers tied the spyware to IPS thanks to an IP address used in its infrastructure that was registered to “IPS Intelligence Public Security.”
http://techcrunch.com/2026/04/24/another-spyware-maker-caught-distributing-fake-android-snooping-apps/

2026-04-10 16:08:52 UTC

- reply

Congrats! Looks like cool merch.

2026-04-02 15:43:30 UTC

NEW: ICE confirms that it's planning to use Paragon's spyware to counter “foreign terrorist organizations’ thriving exploitation of encrypted communication platforms.”
ICE's acting director Todd Lyons said the agency will “comply with constitutional requirements,” without specifying what those are.
It's unclear if the agency’s criminal investigative unit Homeland Security Investigations (HSI) has already used the spyware.
http://techcrunch.com/2026/04/02/ice-says-it-bought-paragons-spyware-to-use-in-drug-trafficking-cases/

2026-03-31 16:03:01 UTC

NEW: Someone hijacked an open-source software development tool to push malware to millions of people.
The supply chain attack was stopped in less than three hours, but it's still unclear how many people got hacked.
https://techcrunch.com/2026/03/31/hacker-hijacks-axios-open-source-project-used-by-millions-to-push-malware/

2026-03-27 14:33:34 UTC

SCOOP: Apple says it's not aware of anyone using Lockdown Mode getting hacked with spyware, on all kinds of devices.
There have already been a couple of documented cases of Lockdown Mode stopping spyware attacks. And there's been one case where an advanced hacking toolkit was designed to bail out if it detected Lockdown Mode on the target device.
If you're worried about spyware, you should use turn this security feature on.
https://techcrunch.com/2026/03/27/apple-says-no-one-using-lockdown-mode-has-been-hacked-with-spyware/

2026-03-26 17:24:48 UTC

NEW: We spoke to a few iPhone security experts about what the discovery of DarkSword means to the long-held assumption that iPhones are very hard to hack.
The answer is nuanced, and not simple. Apple has made significant strides in making iPhones more secure, but DarkSword may change how we think.
http://techcrunch.com/2026/03/26/apple-made-strides-with-ios-26-security-but-leaked-hacking-tools-still-leave-millions-exposed-to-spyware-attacks/

2026-03-26 14:18:09 UTC

NEW: Here's everything you need to know about the new iPhone hacking tool DarkSword.
What is DarkSword? How does it work? Where did it come from? How did it leak online? What can you do about it?
We break it all down in this explainer.
http://techcrunch.com/2026/03/26/a-major-hacking-tool-has-leaked-online-putting-millions-of-iphones-at-risk-heres-what-you-need-to-know/

2026-03-11 16:58:46 UTC

NEW: A hacker broke into a server at the Child Exploitation Forensic Lab in the FBI’s New York Field Office and compromised files related to the Epstein investigation, as first reported by Reuters.
“Following the 2023 cyber incident, the FBI contained the affected network and determined the incident to be an isolated one. The FBI restricted access to the malicious actor and rectified the network,” an FBI spokesperson said.
https://techcrunch.com/2026/03/11/hacker-broke-into-fbi-and-compromised-epstein-files-report-says/

2026-03-10 20:13:45 UTC

NEW: A former DOGE employee allegedly stole Americans' personal data from two large databases at the Social Security Administration, according to a new report.
The former employee allegedly put the databases on a thumb drive and wanted to use them at their new contractor job.
https://techcrunch.com/2026/03/10/doge-employee-stole-social-security-data-and-put-it-on-a-thumb-drive-report-says/

2026-03-10 02:03:17 UTC

SCOOP: The iPhone mass hacking toolkit used by Russian spies was developed at U.S. military contractor L3Harris, former employees said.
The Coruna toolkit was used against Ukrainians during the war and by Chinese cybercriminals, according to Google.
But the toolkit was initially developed for governments in the Five Eyes spy alliance, and it was used in Operation Triangulation, according to one source.
https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/

2026-03-05 21:36:48 UTC

NEW: The FBI said it is investigating a hack on its networks.
The breach affected the FBI's systems to manage wiretaps and surveillace requests, according to CNN.
https://techcrunch.com/2026/03/05/fbi-investigating-hack-on-its-wiretap-and-surveillance-systems-report/

2026-02-23 16:08:45 UTC

NEW: There have been a seemingly endless series of critical flaws and cybersecurity incidents related to Ivanti's VPN appliances in the last few years.
Turns out there was a major one in 2021 that wasn't reported until now, according to Bloomberg.
https://techcrunch.com/2026/02/23/vpn-flaws-allowed-chinese-hackers-to-compromise-dozens-of-ivanti-customers-says-report/

2026-02-11 18:42:07 UTC

NEW: U.S. prosecutors say the hacking tools that Peter "Doogie" Williams stole from defense contractor L3Harris Trenchant could have been used against "millions of computers and devices" worldwide.
The prosecutors also confirmed that Williams "stood idly by while another employee of the company was essentially blamed" for his own actions, as we first reported last year.
Williams said he didn't know the tools could end up in the hands of Russia or other governments.
https://techcrunch.com/2026/02/11/doj-says-trenchant-boss-sold-exploits-to-russian-broker-capable-of-accessing-millions-of-computers-and-devices/

2026-02-11 18:42:07 UTC

- reply

If you wanna read the source material yourself, we have uploaded the most relevant court documents in the case against Peter Williams here:
https://www.documentcloud.org/projects/224000-usa-v-peter-doogie-williams/

2026-02-10 20:43:58 UTC

NEW: Google sent ICE the personal financial data of a student and journalist who attented a pro-Palestinian protest in 2024.
The agency had sent Google an admininistrative subpoena, a request that companies are not mandated to respond to.
https://techcrunch.com/2026/02/10/google-sent-personal-and-financial-information-of-student-journalist-to-ice/

2026-02-03 16:58:06 UTC

NEW: French Police searched the local X offices as part of a criminal investigation for several crimes, including possession and distribution of child sexual abuse material.
Paris prosecutor's office also announced that it summond Elon Musk and former X CEO Linda Yaccarino for questioning.
https://techcrunch.com/2026/02/03/french-police-search-x-office-in-paris-summons-elon-musk-for-questioning/

2026-01-23 17:50:18 UTC

Update to this. 25 days later, White Date is still down.
And Martha Root, the hacker, explained their motivations here, but not any technical details, which they promise are coming soon.
"No, this didn’t happen live on stage. And no it wasn’t a moment straight out of a hacker movie. It was mostly timing, a bit of performance and things that were already unfolding."
https://www.youtube.com/watch?v=lJsS8lqCpwU
https://elk.zone/infosec.exchange/@lorenzofb/115844030264996434

2026-01-23 15:56:13 UTC

NEW: Microsoft handed the FBI the recovery keys to decrypt the hard drives of three laptops encrypted with BitLocker.
BitLocker is enabled by default in modern Windows laptops, but Microsoft also prompts users to upload the recovery keys to the company's cloud, which opens up this possibility.
http://techcrunch.com/2026/01/23/microsoft-gave-fbi-a-set-of-bitlocker-encryption-keys-to-unlock-suspects-laptops-reports/

2026-01-20 20:59:33 UTC

NEW: Two members of Elon Musk’s Department of Government Efficiency (DOGE) who were working at the Social Security Administration may have shared SSNs to help an advocacy group that had the aim "to find evidence of voter fraud and to overturn election results in certain States," according to a court document.
https://techcrunch.com/2026/01/20/trump-administration-admits-doge-may-have-misused-americans-social-security-data/

2026-01-12 20:09:54 UTC

This always works.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/883/939/815/238/314/original/fd3dc61a379108a6.png

2025-12-27 18:51:42 UTC

NEW: Meet the folks at AccessNow's Digital Security Helpline, who have been investigating government spyware abuses for more than a decade, helping journalists and dissidents all over the world.
Hassen Selmi, who heads the incident response team, told me his team looks into around 1,000 cases a year. Half of those turn into full investigations, and around 25 result in confirmed spyware infections.
Here’s how Selmi’s team fights spyware abuses.
https://techcrunch.com/2025/12/27/meet-the-team-that-investigates-when-journalists-and-activists-get-hacked-with-government-spyware/

2025-12-23 19:10:34 UTC

NEW: Hackers stole more than $2.7 billion in crypto last year, according to multiple blockchain monitoring companies.
North Korea alone stole 2 of those billions, thanks to the jackpot of the Bybit hack, which netted them $1.4 billion.
https://techcrunch.com/2025/12/23/hackers-stole-over-2-7-billion-in-crypto-in-2025-data-shows/

2025-12-12 15:39:19 UTC

NEW: A flaw in the website of Hama Film, a photo booth maker with presence in Australia, UAE and the U.S., exposes pictures and videos of its customers.
Security researcher alerted the company last month, no answer. We reached out to the company a few times, no answer.
https://techcrunch.com/2025/12/12/flaw-in-photo-booth-makers-website-exposes-customers-pictures/

2025-12-04 18:17:59 UTC

NEW: Staffers at notorious spyware maker Intellexa had live remote access to their customers' surveillance systems.
This allowed them to see the personal data of targets hacked with Intellexa's spyware Predator, according to new research based on a leaked training video.
Needless to say, this is bad for several reasons.
http://techcrunch.com/2025/12/04/sanctioned-spyware-maker-intellexa-had-direct-access-to-government-espionage-victims-researchers-say/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/662/668/250/729/964/original/4707dafe13bac2a6.jpeg

2025-12-03 19:59:03 UTC

NEW: Your "end-to-end encrypted" poop pictures taken by this $599 (+ subscription) smart toilet camera are actually not end-to-end encrypted.
¯_(ツ)_/¯
https://techcrunch.com/2025/12/03/end-to-end-encrypted-smart-toilet-camera-is-not-actually-end-to-end-encrypted/

2025-11-26 16:17:16 UTC

NEW: A trivial-to-exploit bug in jury systems used across the United States was exposing jurors' sensitive personal data, such as full names, date of birth, occupation, email addresses, cell phone numbers, and home addresses — and potentially even health data.
The bug essentially allowed anyone to brute-force and access jurors' accounts.
The system is provided by gov tech gian Tyler Technologies. We alerted them of the bug on Nov. 5, they acknowledged and said they fixed it yesterday. ** **
https://techcrunch.com/2025/11/26/bug-in-jury-systems-used-by-several-us-states-exposed-sensitive-personal-data/

2025-11-17 15:30:29 UTC

NEW: Delivery giant DoorDash disclosed a data breach impacting an unspecified number of users.
Hackers stole names, emails, phone numbers, and physical addresses, but DoorDash said that “no sensitive information was accessed by the unauthorized third party." 🤔
https://techcrunch.com/2025/11/17/doordash-confirms-data-breach-impacting-users-phone-numbers-and-physical-addresses/

2025-11-12 16:43:53 UTC

NEW: A group of Senators and Congresspeople are warning Governors that their states are providing ICE “with frictionless, self-service access to the personal data of all of your residents.”
The data sharing is managed by a nonprofit called Nlets, which is managed by state police agencies.
https://techcrunch.com/2025/11/12/lawmakers-warn-democratic-governors-that-states-are-sharing-drivers-data-with-ice/

2025-11-07 16:39:39 UTC

NEW: The U.S. Congressional Budget Office was hacked.
@npub1lcc…lcye says that the cause may be an unpatched Cisco ASA firewall. I asked CBO about that but it did not respond to the question.
https://techcrunch.com/2025/11/07/congressional-budget-office-confirms-it-was-hacked/

2025-11-03 21:46:18 UTC

NEW: This is how former L3Harris Trenchant boss Peter Williams was able to steal zero-days worth millions of dollars and sell them to a Russian broker, based on court documents and interviews with his former colleagues.
A former Trenchant employee told me that “no one had any supervision over [Williams] at all. He was kind of allowed to do things the way he wanted to.”
“He was, in my opinion, perceived to be beyond reproach,” the former employee, who has knowledge of Trenchant's IT systems, told me.
http://techcrunch.com/2025/11/03/how-an-ex-l3-harris-trenchant-boss-stole-and-sold-cyber-exploits-to-russia/

2025-10-29 17:42:27 UTC

NEW: Peter Williams, the former head of Western zero-day and spyware maker Trenchant, pleaded guilty to selling eight exploits to a Russian broker that resells to the Russian government.
The DOJ said Williams was promised millions of dollars in exchange for "national-security focused software."
https://techcrunch.com/2025/10/29/former-l3harris-trenchant-boss-pleads-guilty-to-selling-zero-day-exploits-to-russian-broker/

2025-10-23 15:48:33 UTC

NEW: The U.S. govt accused Peter Williams, ex general manager of hacking tool maker L3Harris Trenchant, of stealing trade secrets and selling them to buyer in Russia.
As we reported earlier this week, Trenchant was investigating a leak of internal tools this year. At this point, it's unclear if that investigation is related to the accusations against Williams.
https://techcrunch.com/2025/10/23/u-s-government-accuses-former-l3harris-cyber-boss-of-stealing-trade-secrets/

2025-10-20 14:39:47 UTC

ICYMI (story broke late Friday evening): A judge has ordered NSO Group to stop targeting WhatsApp users.
At the same time the judge reduced the damages the spyware maker had to pay to WhatsApp from $167 million to $4M, becasue there was no evidence NSO’s behavior was “particularly egregious."
http://techcrunch.com/2025/10/18/spyware-maker-nso-group-blocked-from-whatsapp/

2025-09-18 16:45:14 UTC

SCOOP: ICE's Homeland Security Investigation signed a $3 million contract with Magnet Forensics, which makes phone hacking tech for law enforcement agencies that is "essential to mission of protecting national security & public."
Magnet Forensics makes the phone unlocking system Graykey.
We also found other recent contracts for the same technology for HSI in Charlotte and Detroit.
http://techcrunch.com/2025/09/18/ice-unit-signs-new-3-million-contract-for-phone-hacking-tech/

2025-09-15 17:53:24 UTC

Everyone has their own threat models, so I don't want to make broad, sweeping recommendations here, but if you use Protonmail to talk to sources, you should read this story.
The way Protonmail handled this whole thing is quite bad. No transparency, dismissing the story as being "blown out of proportion."
https://theintercept.com/2025/09/12/proton-mail-journalist-accounts-suspended/

2025-08-20 16:20:27 UTC

NEW: The two Harvard students who doxed random people with Meta Ray-Ban glasses are launching "always-on" AI-powered smart glasses that listen, record, and transcribe, everything happening around them.
The glasses don't have an indicator that shows people around them that they are being recorded.
[@evacide](https://hachyderm.io/@evacide ) is not a fan: "Normalizing the use of an always-on recording device, which in many circumstances would require the user to get the consent of everyone within recording distance, eats away at the expectation of privacy we have for our conversations in all kinds of spaces.”
http://techcrunch.com/2025/08/20/harvard-dropouts-to-launch-always-on-ai-smart-glasses-that-listen-and-record-every-conversation/

2025-08-12 17:36:46 UTC

NEW: Two hackers broke into the computer of a hacker allegedly working for the North Korean spy group known as "Kimsuky."
The hackers then leaked a treasure trove of stolen data, exposing a North Korean spy operation against South Korean targets.
“Kimsuky, you’re not a hacker. You are driven by financial greed, to enrich your leaders, and to fulfill their political agenda. You steal from others and favour your own. You value yourself above the others: You are morally perverted,” the two wrote in their Phrack magazine article. “You hack for all the wrong reasons.”
https://techcrunch.com/2025/08/12/hackers-breach-and-expose-a-major-north-korean-spying-operation/

2025-08-04 15:44:17 UTC

NEW: CloudFlare says it detected Perplexity scraping and crawling websites that explicitly block it from scraping them.
Based on customers' complaints and its own experiments, the company says Perplexity is using "stealth" bots and changing its bots "user agent" to circumvent restrictions.
http://techcrunch.com/2025/08/04/perplexity-accused-of-scraping-websites-that-explicitly-blocked-ai-scraping/

2025-07-17 15:47:46 UTC

NEW: Security researchers and CISA warn that hackers are exploiting a flaw in the Signal clone TeleMessage, which could lead to them stealing "plaintext usernames, passwords, and other sensitive data."
@npub1p0l…ajg7, the researcher who analyzed it said they were "in disbelief at the simplicity of this exploit."
https://techcrunch.com/2025/07/17/hackers-are-trying-to-steal-passwords-and-sensitive-data-from-users-of-signal-clone/

2025-07-09 18:39:55 UTC

NEW: Over the weekend, Jack Dorsey launched an open-source chat app called Bitchat, which he promised to be “secure” and “private.”
He then later added a warning that the app not been tested or reviewed for security issues, asking people not to trust it as "it does not necessarily meet its stated security goals."
Security researchers are already finding flaws in it.
https://techcrunch.com/2025/07/09/jack-dorsey-says-his-secure-new-bitchat-app-has-not-been-tested-for-security/

2025-06-30 16:16:26 UTC

NEW: A U.S. government report says a Mexican drug cartel hacker spied on an FBI official to identify, track, and kill informants.
The hacker also hacked into Mexico City's camera network to follow the FBI official as they met with “people of interest” for the cartel, according to the report.
http://techcrunch.com/2025/06/30/mexican-drug-cartel-hacker-spied-on-fbi-officials-phone-to-track-and-kill-informants-report-says/

2025-06-18 16:26:37 UTC

NEW: The internet has collapsed in Iran on Wednesday, with one web monitoring firm saying the country is “now in the midst of a near-total national internet blackout.”
“We can only see that the traffic dropped — the data doesn’t tell us why it dropped,” said David Belson, the head of data insight at internet infrastructure company Cloudflare.
https://techcrunch.com/2025/06/18/internet-collapses-across-iran-say-web-monitoring-firms/

2025-06-12 17:12:11 UTC

NEW: Four months after releasing iOS 18.3.1, Apple has published details about a zero-day that it fixed at the time, but did not publicize.
This is the iPhone zero-day used against the two European journalists targeted with Paragon spyware, according to Citizen Lab.
It's unclear why Apple did not publish information about this zero-day until today.
https://techcrunch.com/2025/06/12/apple-fixes-new-iphone-zero-day-bug-used-in-paragon-spyware-hacks/

2025-06-12 15:37:53 UTC

- reply

UPDATE: COPASIR, the Italian parliament committee that investigated the Paragon scandal referred to a section in its report that says it could expand its inquiry, including into "the alleged mobile device intrusions disclosed by two other journalists in recent weeks."
Obviously one of those two journalists is Pellegrino. The other...I am not sure. (Can't be this new European journalist since the report was published last week).
https://techcrunch.com/2025/06/12/researchers-confirm-two-journalists-were-hacked-with-paragon-spyware/

2025-06-12 14:56:24 UTC

- reply

As always, worth reading Citizen Lab's whole report here:
https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

2025-06-12 12:59:21 UTC

NEW: Researchers found forensic evidence of Paragon's spyware on the iPhones of two journalists.
One is Ciro Pellegrino, who works for Fanpage. The other is an unnamed prominent European journalist. They are the first confirmed cases of infection with Paragon's spyware "Graphite."
This revelation show that the spyware scandal that, for now, seemed mostly focused on Italy may expand further in Europe.
http://techcrunch.com/2025/06/12/researchers-confirm-two-journalists-were-hacked-with-paragon-spyware/

2025-06-06 20:19:31 UTC

NEW: An Italian parliament inquiry concluded that the Italian government used Paragon's spyware to hack activists working to rescue immigrants.
The committee, however, said it did not find any evidence that Italy's intelligence agencies (nor anyone else) spied on journalist Francesco Cancellato.
The peport leaves a this, and other, key questions unanswered.
http://techcrunch.com/2025/06/06/italian-lawmakers-say-italy-used-spyware-to-target-phones-of-immigration-activists-but-not-against-journalist/

2025-06-02 13:53:47 UTC

We have finished going through the court docs and hearing transcripts from the WhatsApp v. NSO lawsuit.
Here's everything we learned, from how NSO's customers use Pegasus, to the spyware's cost.
https://techcrunch.com/2025/05/30/eight-things-we-learned-from-whatsapp-vs-nso-group-spyware-lawsuit/

2025-05-12 14:13:05 UTC

NEW: Last week, WhatsApp won a huge court battle against spyware maker NSO, which now has to pay $167,000,000 in damages to the tech giant.
As part of the lawsuit and trial, a lot of details have come out about NSO and the cyberattack underpinning the lawsuit. We are reading the hundreds of pages of court docs and hearing transcripts to recap the biggest revelations.
Here they are:
http://techcrunch.com/2025/05/10/five-things-we-learned-from-whatsapp-vs-nso-group-spyware-lawsuit/

2025-05-07 17:36:07 UTC

- reply

For context: just three days ago CrowdStrike said it delivered "record full year operating cash flow of $1.38 billion and record full year free cash flow of $1.07 billion."
And CEO George Kurtz made $46 million last year.
https://aflcio.org/paywatch/CRWD & https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-reports-fourth-quarter-and-fiscal-year-2025

2025-05-07 14:27:11 UTC

NEW: CrowdStrike announced that it will lay off around 500 workers as part of "a strategic plan" to "to evolve its operations to yield greater efficiencies."
The cuts represent 5% of its global workforce.
https://techcrunch.com/2025/05/07/crowdstrike-says-it-will-lay-off-500-workers/

2025-05-05 13:54:27 UTC

Skype is getting shut down today. It was certainly one of the most revolutionaries chat apps in history.
Skype was the first major chat app to implement end-to-end encryption, prompting authorities all over the world to freak out about it, and look at spyware as a solution.
“Skype calls have excellent sound quality and are highly secure with end-to-end encryption,” Skype’s homepage read in 2004.
https://techcrunch.com/2025/03/03/as-skype-shuts-down-its-legacy-is-end-to-end-encryption-for-the-masses/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/455/559/068/055/251/original/0ff0d0c618294fc3.png

2025-04-29 15:16:41 UTC

NEW: A court in India has ordered the block Proton Mail across the whole country as part of a case where a local design firm received obscene emails.
As of this writing, Proton Mail is still working, based on our tests.
Story by @npub1s7s…f3s3
https://techcrunch.com/2025/04/29/indian-court-orders-blocking-of-proton-mail/

2025-04-29 13:28:21 UTC

NEW: Last year, there were 34 recorded zero-days being exploited in real-world attacks, which were attributed to specific groups.
Of those, 23 were attributed to government-backed hackers, including spyware makers, which shows that governments are the main users of zero-days.
And while those got caught, Google's [@_clem1](https://bird.makeup/users/_clem1 ) told us that spyware makers “are investing more resources in operational security to prevent their capabilities being exposed and to not end up in the news.”
Full story:
https://techcrunch.com/2025/04/29/government-hackers-are-leading-the-use-of-attributed-zero-days-google-says/

2025-04-28 16:11:24 UTC

NEW: Citizen Lab found that hackers targeted Uyghurs in exile with Windows spyware disguised as a Uyghur language text editor.
People were alerted by Google of potentially having been targeted by "government-backed attacks."
https://techcrunch.com/2025/04/28/citizen-lab-say-exiled-uyghur-leaders-targeted-with-windows-spyware/

2025-04-16 15:44:27 UTC

NEW: In a hearing last week, an NSO Group lawyer said that Mexico, Saudi Arabia, and Uzbekistan were among the governments responsible for a 2019 hacking campaign against WhatsApp users.
This is the first time representatives of the spyware maker admit who its customers are, after years of refusing to do that.
http://techcrunch.com/2025/04/16/nso-lawyer-names-mexico-saudi-arabia-and-uzbekistan-as-spyware-customers-behind-2019-whatsapp-hacks/

2025-04-15 16:58:22 UTC

NEW: The notorious image board 4chan has been hacked.
Site has been intermittently down for hours, and hackers have published screenshots of site's backend, alleged source code, and list of moderators and "janitors."
One janitor told us they are "confident" data is "all real."
https://techcrunch.com/2025/04/15/notorious-image-board-4chan-hacked-and-internal-data-leaked/

2025-04-09 18:29:03 UTC

NEW: A recently published court document shows the locations of WhatsApp victims targeted with NSO Group's spyware.
The document lists 1,223 victims in 51 countries, including Mexico, India, Morocco, United Kingdom, United States, Spain, Hungary, Netherlands, etc.
This targeting was over a span of around two months in 2019, according to WhatsApp's lawsuit against NSO Group.
http://techcrunch.com/2025/04/09/court-document-reveals-locations-of-whatsapp-victims-targeted-by-nso-spyware/

2025-04-01 16:17:44 UTC

Wanna earn up to $100,000 a month? Perhaps doing crime? For obscure reasons? This is your opportunity.
Don't miss out on this bizarre hacking campaign, which is currently looking for recruits here on Twitter.
🤔 🤔 🤔
https://techcrunch.com/2025/04/01/someone-is-trying-to-recruit-security-researchers-in-bizarre-hacking-campaign/

2025-03-31 18:22:58 UTC

NEW: Oracle is apparently dealing with two separate breaches — one affecting Oracle Cloud, and one Oracle Health — but the company refuses to say what's actually going on.
Both public and employees are confused at this point, as there is little transparency.
Here's a recap of what's happening.
https://techcrunch.com/2025/03/31/oracle-under-fire-for-its-handling-of-separate-security-incidents/

2025-03-21 20:02:32 UTC

NEW: Valve removed a video game from Steam after users reported that its free demo was actually an infostealer malware.
Very similar thing happened last month with another video game laced with malware.
https://techcrunch.com/2025/03/21/valve-removes-video-game-demo-suspected-of-being-malware/

2025-03-20 21:05:01 UTC

The official website of zero-day broker Zerodium has been updated in December of last year. There are no price lists nor any information anymore, just an email and a PGP public key.
🤔
If you know what's happening there...let me know.
https://zerodium.com
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/196/787/821/687/783/original/998ca51a715ec5e5.png

2025-03-19 20:59:19 UTC

- reply

The Ontario Public Police responded to our request for comment without denying being Paragon customers.
Instead a spokesperson said that "releasing information about specific investigative techniques and technology could jeopardize active investigations."
https://techcrunch.com/2025/03/19/researchers-name-several-countries-as-potential-paragon-spyware-customers/

2025-03-19 12:59:29 UTC

NEW: Citizen Lab researchers mapped out the infrastructure of spyware maker Paragon Solutions, and say they were able to identify servers likely used by customers in several countries: Australia, Canada, Cyprus, Denmark, Israel, and Singapore.
Paragon’s executive chairman John Fleming said Citizen Lab shared in advance "very limited amount of information, some of which appears to be inaccurate."
He declined to say what was inaccurate exactly.
https://techcrunch.com/2025/03/19/researchers-name-several-countries-as-potential-paragon-spyware-customers/

2025-03-14 15:20:19 UTC

I wish I was surprised by this.
Morgan Marquis-Boire, a well known hacker who has faced multiple credible accusations of sexual violence, was secretly running a crypto security company.
https://www.washingtonpost.com/technology/2025/03/14/cryptocurrency-unciphered-morgan-marquis-boire/

2025-03-13 16:54:10 UTC

NEW: Lockdown Mode has become a must-use for dissidents, activists, and journalists.
But Lockdown Mode's notifications are extremely baffling, and nobody understands what they are trying to say, or what is Lockdown Mode actually doing.
Apple refused to provide any explanations. For the love of god, Apple, please fix this mess.
http://techcrunch.com/2025/03/13/apples-lockdown-mode-is-good-for-security-but-its-notifications-are-baffling/

2025-03-11 14:54:14 UTC

I am starting to think these Lockdown Mode notifications are even dumber and confusing than I thought.
I get them all the time while I chat with someone, for example, after their first message. Apparently, they don't do anything because the conversation keeps going. (This happens with people who are in my contact list btw)
But then, the other day I saw one one of these warnings, which named a person I wasn't messaging with at the time.
Should I assume this means they were messaging me and Lockdown Mode prevented them?
Does anyone know what these notifications actually mean? Or what they are supposed to tell a Lockdown Mode user?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/144/369/277/731/407/original/02f61f93e9f965f1.jpeg

2025-02-28 19:41:36 UTC

NEW: Google fixed three zero-day vulnerabilities in Android that were used by authorities to unlock phones with Cellebrite forensic tools.
The fixes come after Amnesty alerted Google, following the analysis of a Serbian student protester's phone.
https://techcrunch.com/2025/02/28/researchers-uncover-unknown-android-flaws-used-to-hack-into-a-students-phone/

2025-02-26 18:41:37 UTC

NEW: Hacked crypto exchange Bybit is offering $140 million in bounties to anyone who can help locate and freeze the stolen ethereum.
Bybit also disclosed preliminary results of investigations, which reveal hackers breached a developer’s device at a wallet platform Safe Wallet.
http://techcrunch.com/2025/02/26/hacked-crypto-exchange-bybit-offers-140-million-bounty-to-trace-stolen-funds/

2025-02-20 16:45:30 UTC

Updates on Paragon scandal in Italy via Guardian:
-Journalist union filed criminal complaint due to Meloni's government not answering Qs. <li>President of 🇮🇹 parliament invoked rule to not respond Qs claiming all unclassified info has been made public.</li>
-Italy's foreign intelligence agency AISE, confirmed it is a customer of Paragon in Parliament, and that the the contract is suspended.
Still lots of unanswered questions.
https://www.theguardian.com/world/2025/feb/19/journalists-launch-legal-action-against-italian-government-over-spyware-claims
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/037/220/887/327/880/original/6738828e94746066.png

2025-02-18 17:03:28 UTC

NEW: We have curated a list of people who are working, or are at least associated, with the Department Of Government Efficiency, or DOGE.
There have been a few lists like these, and they are great. We have some new details here.
https://techcrunch.com/2025/02/18/the-people-in-elon-musk-doge-universe/

2025-02-10 19:32:47 UTC

NEW: Apple released a fix for a zero-day bug for iOS and iPadOS that “may have been exploited in an extremely sophisticated attack against specific targeted individuals.”
AFAIK this is the first time Apple uses "extremely sophisticated attack" in an official release. At this point, we don't know who abused the flaw, nor against whom.
https://techcrunch.com/2025/02/10/apple-fixes-iphone-and-ipad-bug-used-in-an-extremely-sophisticated-attack/

2025-02-03 19:31:32 UTC

NEW: We spoke to the Italian journalist who was targeted on WhatsApp with government spyware made by Paragon.
“I feel violated,” Francesco Cancellato told me. “It is actually quite strange for a journalist to be spied on in a Western democracy.”
Cancellato is the director of Fanpage.it, which last year published a damning investigation on the youth wing of the current far-right government in Italy.
Full story, which includes the text of the notification he received from WhatsApp, here:
http://techcrunch.com/2025/02/03/journalist-targeted-on-whatsapp-by-paragon-spyware-i-feel-violated/

2025-01-31 20:54:20 UTC

- reply

Italian journalist Francesco Cancellato said he was one of the targets of the hacking campaign, after he received the notification from WhatsApp.
"It is also our interest to know, if it is possible to do so, who ordered this espionage activity,” he said.
https://x.com/fcancellato/status/1885424788237082900

2025-01-31 20:44:21 UTC

- reply

We updated the story to include new details from WhatsApp: the targets were in more than two dozen countries, including Europe.
https://techcrunch.com/2025/01/31/whatsapp-says-it-disrupted-a-hacking-campaign-targeting-journalists-with-spyware/

2025-01-31 15:16:51 UTC

NEW: WhatsApp says it has notified 90 victims, including journalists and members of civil society, that they were targeted with spyware made by Paragon.
The company said the technique used in the campaign, which relied on malicious PDFs sent via chat groups, has now been fixed.
This is the first time that Paragon is linked to alleged abuse of its products.
https://techcrunch.com/2025/01/31/whatsapp-says-it-disrupted-a-hacking-campaign-targeting-journalists-with-spyware/

2025-01-27 22:35:59 UTC

With iOS 18.3, Apple is switching Apple Intelligence on by default (for newer devices). Given how faulty it is, and maybe for other concerns (environment, ethical), you may want to switch it off.
Here's how to do it:
https://techcrunch.com/2025/01/27/how-to-switch-off-apple-intelligence-on-your-iphone-ipad-and-mac/

2025-01-09 17:54:04 UTC

NEW: Facebook awarded a researcher $100,000 for finding a bug in an ad platform that gave access to FB's internal infrastructure.
Ben Sadeghipour told TechCrunch that online advertising platforms make for juicy targets because, “there's so much that happens in the background of making these 'ads' — whether they are video, text or images."
"But at the core of it all it's a bunch of data being processed on the server-side and it opens up the door for a ton of vulnerabilities,” he said.
https://techcrunch.com/2025/01/09/facebook-awards-researcher-100000-for-finding-bug-that-granted-internal-access/

2024-12-20 14:23:03 UTC

NEW: Cybersecurity experts, who work with human rights defenders and journalists, agree that Apple is doing the right thing by sending notifications to victims of mercenary spyware — and at the same time refusing to forensically analyze the devices.
“These notifications have been a game changer for spyware accountability research," said John Scott-Railton, a senior researcher at the Citizen Lab, who has been investigating government spyware for more than a decade.
https://techcrunch.com/2024/12/20/why-apple-sends-spyware-victims-to-this-nonprofit-security-lab/

2024-12-16 14:26:08 UTC

NEW: Amnesty International has documented two cases where Serbian authorities used Cellebrite to unlock the phones of a journalist and an activist.
And then they installed spyware on the devices.
In a way, this is a return to the old days of government spyware, where remote attacks were rare and impractical, and cops needed to get their hands on target's computers.
https://techcrunch.com/2024/12/15/serbian-police-used-cellebrite-to-unlock-then-plant-spyware-on-a-journalists-phone/

2024-12-09 17:39:19 UTC

NEW: Ukraine’s Computer Emergency Response Team (CERT-UA) says Russian government hackers are targeting the country's defense sector with phishing emails.
The phishing emails were designed to look like they were invitations to a real conference.
https://techcrunch.com/2024/12/09/ukraine-says-russian-hackers-are-targeting-countrys-defense-contractors/

2024-11-20 19:36:22 UTC

NEW: The U.S. government has announced charges against five alleged hackers who targeted several companies stealing millions of dollars in crypto, and corporate data.
DOJ says the hackers are part of the infamous Scattered Spider cybercrime group, who "perpetrated a sophisticated scheme to steal intellectual property and proprietary information worth tens of millions of dollars and steal personal information belonging to hundreds of thousands of individuals.”
https://techcrunch.com/2024/11/20/us-charges-five-accused-of-multi-year-hacking-spree-targeting-tech-and-crypto-giants/

2024-11-15 20:56:53 UTC

NEW: WhatsApp forced a judge to release previously non-public court documents, which include a ton of details on how NSO's spyware works.
The documents show how NSO targeted WhatsApp, the number of customers the company had to cut off because of abuse, and more.
Here are the biggest revelations.
https://techcrunch.com/2024/11/15/nso-group-admits-cutting-off-10-customers-because-they-abused-its-pegasus-spyware-say-unsealed-court-documents/

2024-11-13 20:07:27 UTC

NEW: A Spanish lawyer allegedly hacked with NSO's spyware is naming the founders of the company in his lawsuit against NSO.
This appears to be the first time a victim of spyware is going directly after the people behind the surveillance tech makers.
“[Lawyer] Van Den Eynde was spied on to gain access to his clients and the legal strategy of the cases he was handling, creating a chain effect of rights violations: by spying on him, all his contacts were indirectly spied on,” a nonprofit working on the wrote in a press release. “What is more, this surveillance is carried out without any criminal proceedings being brought against him and therefore without any judicial control.”
https://techcrunch.com/2024/11/13/lawyer-allegedly-hacked-with-spyware-names-nso-founders-in-lawsuit/

2024-11-13 16:06:15 UTC

Does anyone track every lawsuit against NSO around the world by any chance?

2024-10-17 17:16:23 UTC

NEW: Feds announced the arrest and indictment of Eric Council Jr., accusing him of being part of a group of hackers who took over the official Securities and Exchange Commission's X account.
Council Jr. allegedly performed a SIM swap to get into the X account of a person with access to the @ SECgov account on X. The hackers then posted a fake tweet about Bitcoin that boosted the price up by $1,000.
https://techcrunch.com/2024/10/17/feds-arrest-man-who-allegedly-participated-in-hack-of-the-secs-x-account-boosting-bitcoins-price/

2024-10-09 15:53:37 UTC

NEW: Hackers are exploiting a zero-day in 64 different Qualcomm chips to target Android users.
No details on this hacking campaign, but everything points to targeted attacks against civil society (journalists, dissidents) given that Google TAG and Amnesty are involved.
Qualcomm has released a patch but it's now up to Android phone makers to implement it and push it out to users, which could take a while.
https://techcrunch.com/2024/10/09/hackers-were-targeting-android-users-with-qualcomm-zero-day/

2024-10-08 16:01:03 UTC

NEW: Kaspersky is shutting down its U.K. office and laying off dozens of employees there.
Company spokesperson told us that “will commence a wind-down of the U.K. office operations," and that there are "less than 50 employees" in the London office.
https://techcrunch.com/2024/10/08/kasperksy-says-its-closing-down-its-uk-office-and-laying-off-dozens/

2024-09-19 17:32:32 UTC

NEW: Apple's latest operating system, macOS 15 Sequoia, has broken some cybersecurity products and tools.
CrowdStrike, for example, has delayed support for Sequoia until Apple fixes the issues. Bugs impact Microsoft Defender for Mac, SentinelOne, and potentially others.
"I get it, that writing bug free software is challenging, but maybe if Apple spent less time and money on marketing, and more time on actually testing their software, we'd all be better off!” macOS security expert Patrick Wardle told me.
https://techcrunch.com/2024/09/19/apples-new-macos-sequoia-update-breaks-cybersecurity-tools-experts-say/

2024-09-18 16:30:36 UTC

NEW: The FBI director said today that the U.S. government took over and disrupted a botnet made of 260,000 Internet of Things devices.
U.S government accused a company in China of running the botnet on behalf of the Chinese government.
The botnet was run using Mirai, the infamous malware used in 2016 to launch massive DDoS attacks using hacked IoT devices.
https://techcrunch.com/2024/09/18/u-s-government-took-control-of-a-botnet-run-by-chinese-government-hackers-says-fbi-director/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/159/506/068/580/802/original/acd8c200e060131d.png

2024-09-13 14:38:38 UTC

NEW: Cybersecurity giant Fortinet confirms data breach affecting “less than 0.3%” of customers. Based on company's latest earnings, that should be around 1,500 customers.
https://techcrunch.com/2024/09/13/fortinet-confirms-customer-data-breach/

2024-09-12 14:18:38 UTC

NEW: A hacker and artist found a way to trick ChatGPT into telling him detailed step by step instructions on how to make a fertilizer bomb.
The trick was to tell the chatbot to play a game and then getting it to create an elaborate sci-fi fantasy world. The artist, who goes by Amadon, called it “social engineering hack to completely break all the guardrails around ChatGPT’s output.”
https://techcrunch.com/2024/09/12/hacker-tricks-chatgpt-into-giving-out-detailed-instructions-for-making-homemade-bombs/

2024-09-09 14:23:43 UTC

NEW: A bug in how WhatsApp implements the "View Once" privacy feature lets anyone save pictures and videos that should actually be ephemeral.
The bug is being actively exploited online, including with browser extensions that make it trivial to bypass the "View Once" feature.
WhatsApp told us it's working on "rolling out updates" to fix the issue.
https://techcrunch.com/2024/09/09/bug-lets-anyone-bypass-whatsapps-view-once-privacy-feature/

2024-09-06 14:14:38 UTC

NEW: Telegram quietly changed its official FAQ, specifically the part about its policies around illegal content in chats and group chats.
Until yesterday, the first line of that FAQ said: “All Telegram chats and group chats are private amongst their participants. We do not process any requests related to them.”
That line is now gone. And Telegram also added a line about the EU Digital Services Act.
https://techcrunch.com/2024/09/05/telegram-quietly-enables-users-to-report-private-chats-to-moderators-after-founders-arrest/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/091/022/095/415/508/original/b116405793cf7540.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/091/022/235/353/037/original/1f6b95db9b2a57f7.png

2024-09-04 19:47:17 UTC

NEW: X is hiring two dozen trust and safety, and security folks, after two years of layoffs which gutted the company, and those teams in particular.
For context, last year X disclosed that it had cut 80% of trust and safety staff in the Musk era.
More detailed stats about the mass firings in the below chart, courtesy of Australia's online safety commissioner.
https://techcrunch.com/2024/09/04/x-is-hiring-staff-for-security-and-safety-after-two-years-of-layoffs/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/081/005/707/924/024/original/3955a5cfa068b339.png

2024-08-27 18:24:50 UTC

In this article Clement Lecigna, of Google's Threat Analysis Group, says Google doesn't make distinctions between Western and non-Western malware operations.
https://www.nzz.ch/english/googles-spyware-hunters-track-state-sponsored-malware-ld.1845068
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/035/384/519/831/147/original/5ebcb46835058f60.png

2024-08-21 17:58:19 UTC

Are you angry at your iPhone? You can crash it with just these four characters:
""::
You are welcome!
https://techcrunch.com/2024/08/21/typing-these-four-characters-could-crash-your-iphone/