short, practical notes about not getting phished. no fear mongering, just the checklist.
EXIF GPS coordinates, PDF producer strings and Word author fields have ended more pseudonymous careers than any exploit. A look at the documented cases, and at what actually removes metadata and what only looks like it does.
End-to-end encryption protects message content, but delivery still leaves traces: connection times, IP addresses and identifiers. A plain look at what Signal, SimpleX, Session and federated XMPP actually see, and where published disclosures back the claims.
Fake "Airport_Free_WiFi" hotspots and counterfeit captive portals remain a real travel risk. Australian prosecutions for evil-twin Wi-Fi at airports and on domestic flights show what the trick harvests, what HTTPS stops, and what it does not.
Device-code phishing tricks victims into entering an attacker's code at a genuine login page and approving the sign-in themselves, handing over a working session without a password. How the technique defeats MFA, the red flags, and the defences that hold up.
Attackers holding a valid password can flood a phone with approval prompts until someone taps approve. How MFA fatigue works, what the Uber and Cisco breaches showed, and why number matching and hardware keys change the outcome.
AiTM phishing kits and infostealer logs increasingly trade in authenticated sessions rather than passwords: a stolen session cookie is already past the MFA wall. A look at how session hijacking works and which defenses actually hold.
A working reference to darknet market vocabulary: what exit scam, rug pull, vendor bond, finalize early, FUD, mirror, canary and OPSEC actually name, and why each term was coined.
Kaspersky's GReAT team links the BlackX UEFI bootkit to APT41 and an espionage campaign against diplomatic organizations in Central Asia. It exploits the Baton Drop Secure Boot bypass (CVE-2022-21894), which stays exploitable when the manual revocation step was skipped.
In early September 2026, the FBI opened a probe into Nexus, a darknet service selling scans of more than 153 million US and Canadian driver's licenses, apparently sourced from identity-verification firm IDScan.net. The case shows why KYC data is the darknet data trade's most durable commodity, and what to do if your scan is in a dump.
Citizen Lab reports that merely displaying a targeted advertisement was enough to infect employees' devices with mercenary spyware commissioned by the Israeli ad-tech firm Discover-Tech. Major ad platforms and industry bodies have since cut the company's access.
Attackers used leaked GitHub developer tokens to push a credential-stealing payload as litellm v1.107.0 to PyPI and Docker Hub on October 21, 2026 — the project's second pipeline compromise of 2026, after March's TeamPCP backdoor. Cloud keys, Kubernetes secrets and AI API keys were among the targeted data.
Ledger confirmed that devices sold through Southeast Asian reseller CryptoBilis contained a hardware implant hidden behind the display, capturing 24-word recovery phrases during setup and transmitting wallet keys over a mobile network. According to Bitquery, unconfirmed by Ledger, suspected losses reach $93.2 million across 315 wallets on six chains; Tether has frozen roughly $10 million in USDT.
