Featured Article
North Korea Is Sitting on US$3 Billion Nobody Can Freeze
Binance has repaid its customers, but around US$3 billion stolen by North Korea still sits in bitcoin and ether no issuer can freeze. Automated laundering, a Polygon hard fork proposal, terrorism judgment creditors, and stalled sanctions now decide whether Pyongyang ever profits from the theft.
Explore by Topic
Adversaries
Tradecraft
Technology
Geopolitics
Latest Articles
Google Closed Its Bug Bounty Because AI Drowned It
On October 1, Google paused its open-source bug bounty, drowned in AI-generated reports that were not real vulnerabilities. The attack is not on the code. It is a denial-of-service on the human attention that secures it. AI does not need to find the zero-day, only bury it.
China Phished the People Who Write America's AI Rules
To learn where US AI policy is heading, you do not breach a frontier lab. You phish the analysts who shape it. China-aligned TA419 did that, impersonating a former White House official and an Anthropic employee. The model tells you what America can build. The inbox tells you what it plans to do.
ShinyHunters Survived Every Arrest but Now Someone Is Talking
Jordanian authorities detained Rey, an admin who seized the ShinyHunters brand, and he is reportedly helping the FBI. Jailing a member never killed the brand. The leak sites are already back. But a cooperating insider attacks the one thing the collective cannot do without. Trust between its members.
Microsoft's 2026 Threat Report Is Really About 2020
Microsoft's 2026 Digital Defense Report leads with autonomous AI ransomware. Read it in full and it argues the opposite. The most detected bug in the data is Zerologon, patched in 2020. Attackers log in with stolen credentials. AI did not change how you get breached, only how fast.
Eleven Years After the OPM Breach the Pentagon Lost Three Million More Records
OPM was supposed to be the breach that changed everything. Eleven years later, a Pentagon data hub exposed 3 million defense personnel through a file-sharing flaw nobody watched for nine months. DoD wrote the fix into its own 2022 strategy, then skipped it. The warehouses are still open.
You Can Seize the Servers, Not the Business Model
Spanish police arrested a 16-year-old and named him the administrator of KillSec, tied to 500 ransomware attacks. The age is not the story. A productized platform and AI now do the work a skilled crew once did. Police can seize the servers and kill the brand, not the business model.
Attackers Borrowed ChatGPT's Reputation to Deliver Malware
Strip this attack down and almost none of it is new. Malvertising, a fake captcha, a copy-paste powershell lure, a remote access trojan at the end. Except one brick. One front door was a ChatGPT custom GPT hosted on OpenAI's own domain. The real exploit was borrowed reputation, not the malware.
Arresting One Hacker Does Not Kill a Collective
Dutch police arrested a 24-year-old in the ShinyHunters investigation, and the case looks less like a clean win the closer you read it. The evidence tying him to the breaches is a reused alias and a disputed voice, against a collective that has no membership and publicly laughed off the arrest.
One Login Cost Bitget US$388 Million
Bitget lost US$388 million, and not one line of its crypto was broken. No stolen keys, no smart-contract flaw. Attackers exploited a zero-day in a third-party security product, walked in with valid admin credentials, and moved the money out disguised as routine operations.
Why I Finally Left the iPhone for Android
For almost eighteen years, my primary phone was never really a decision. It was an iPhone. Now it is a Samsung, and not because Android is better. In plenty of ways it is not. It became the phone my hand keeps reaching for, and working out why turned into something worth writing about.