Rado RC1

Exploitation, hardware, embedded, reverse engineering, automotive security. Pwn2Own Master of Pwn Flashback team (@FlashbackPwn).

[[email protected] @daviddiaul]

Offensive cybersecurity is changing fast. ⚡️🧠

I’m looking for people in #offensive #cybersecurity who want to move beyond traditional vuln research and start integrating AI/LLM workflows into real #vulnerability #research.

Want to help shape what comes next? Reach out.

Job links in the reply 👇

#OffensiveSecurity #VulnerabilityResearch #LLM #AI #CyberSecurity

[Rado RC1 @RabbitPro]

@FuzzySec Worse case scenario to play bingo 😅

[Rado RC1 @RabbitPro]

I had a lot of discussions at offcon26 about the state of the AI, the impact it creates and the future of offensive security industry.

Opinions from “it’s a new AFL” to “we’re doomed”.

Are we going to meet all together next year at offcon27? Are you bullish or bearish on AI?

[Rado RC1 @RabbitPro]

@viperbjk You are probably right. However a lot of impact and experimentation before we settle on what’s possible and what’s not. With winners and losers as we define it.

[Rado RC1 @RabbitPro]

@saidelike @offensive_con I really liked Natashenka’s story how Gemini refused to help her :p

[Raelize @raelizecom]

We let Claude reproduce our EM fault injection attack on Google's TV Streamer 4K — from restricted adb shell to root — using only our presentation slides and the tool manuals as input.
Time to root in <15 minutes. 🤯
Full write-up 👇
https://t.co/Wgl3EjiGF9

[Rado RC1 @RabbitPro]

@viperbjk @pedrib1337 Good luck on your training next week! Pity you are not at offcon this year but hope to see you next year.

[Rado RC1 @RabbitPro]

Together with @pedrib1337 we just completed the HZED training! Was amazing and we learned a lot!

[Flashback Team @FlashbackPwn]

We haven't been sleeping... we've been cooking!
Join us at https://t.co/0cNAnIDbAH

[quarkslab @quarkslab]

🚗 We traced a car’s life from China to Poland.
By analyzing a BYD Telematic Control Unit, Romain Marchand reconstructed its journey and identified a real-world event from GPS logs alone.
Embedded forensics + OSINT = real stories hidden in data.
👉 https://t.co/O408d2gbj9

[Rado RC1 @RabbitPro]

@b1ack0wl @IamAlch3mist Excuse me Sir. That board has some strangely looking hanging cables. Is that legit, surely it hasn’t been modified in the supply chain by the b1ack0wl Distribution Inc?

[Rado RC1 @RabbitPro]

Overheard this in conversation:

If Germany created its own version of LLM we would need to send prompts via fax. 📠

Waiting for European models!

[Rado RC1 @RabbitPro]

@steventseeley No wheelies but still badass.

[Kuba Gretzky @mrgretzky]

Open source is dying a slow, painful death.

For the time being, the AI-related issues in the open-source space have been largely attributed to the flood of AI-slop-generated code contributions, which human project maintainers were unable to process because the effort required to validate each contribution far exceeded the quality of those contributions.

Now Cloudflare, by slop-forking Next.js, has just validated that it's okay to take an open-source project, shove it into an LLM, and have it vibe-code a completely new product based on the source code the engine was fed.

The question arises: if AI regenerates the source code of an open-source project entirely, does the original open-source license still apply?

We're approaching the Slop Ages, where protecting your IP from AI heists becomes virtually impossible. We've seen it in the music industry, and the time has come for the software industry.

I am a software developer myself, and Evilginx has been open-sourced for over 8 years. That's why this news story rubs me the wrong way on a personal level.

Evilginx is an offensive security tool - a phishing framework focused on bypassing MFA. Due to its dual-use nature, it can be used either by the good guys to demonstrate the weaknesses of the company's MFA implementation or by the bad guys for malicious purposes, mainly to harm others.

I had countless second thoughts since the release of the open-source version, whether it was a good idea to put it out there, and later update it with new features, knowing that on one hand it will popularise the problems around weak MFA, and on the other hand give the bad guys a jump-start to expand their criminal enterprise.

It was no surprise to me to learn later that APT groups like Scattered Spider or Void Blizzard reportedly created their own phishing toolkits, based on publicly exposed Evilginx source code.

The main reason I launched Evilginx Pro as a closed-source, paid product last year was a combination of wanting to aid the good guys while gatekeeping the tool from the bad guys (and, of course, building a business out of it).

It has always been important to me to make the community version of the tool accessible to everyone. Still, I was not a fan of the collateral; this decision also carried.

Getting back to my original point.

We now live in a world where a threat actor can feed the GitHub source code of any offensive security tool into an AI and prompt it to create something completely different from scratch, with more features and easier to use. Security issues arising from vibe-coding become a secondary concern in this scenario and can be largely disregarded.

Over the last 2 years, I've been making significant improvements to the Evilginx proxy engine. The majority of these changes have now been implemented in Evilginx Pro. One of the upcoming major updates is the introduction of the new Phishlets 2.0 format.

The plan is to release Phishlets 2.0, together with the proxy engine improvements, as part of the major update to the Evilginx community edition and make it accessible to everyone. As you may've guessed by now, my main concern is whether to release it as open-source or closed-source.

Going the open-source route, I risk threat actors spending a few hundred bucks on a Claude subscription to create their own derivatives of Evilginx, which they can later rebrand and sell on the dark web.

The closed-source route allows me to still release the tool to the public, with proper guardrails to prevent misuse, while keeping it accessible to people who want to use Evilginx to learn hands-on how MFA is bypassed in phishing engagements.

I don't feel that open source is the proper delivery method for offensive security tooling anymore.

The AI has completely reshaped the open-source ecosystem. Writing code is no longer dark magic; it is more accessible than ever, but it has also introduced the cancer we will have to learn to live with.

I use AI to generate small helper libraries, while the rest of the Evilginx code is written by hand. Not because I reject the new AI-oriented reality we live in, but because I really enjoy programming. My love of programming brought me to this point in life.

I also enjoy the concept of ownership. By releasing your work into the world, you let everyone know that you made it, that you personally vouch for its quality, and that you own any mistakes you make. This is what builds trust and reputation.

With AI-generated software, there is neither.

- Kuba

P.S. I refrained from using an LLM to correct this post to avoid adding to the irony of the matter.

[[email protected] @daviddiaul]

Looking to connect with folks 🧠 doing #browser 🌐 #vulnerabilityresearch, #exploitdev, #fuzzing etc 🐛 DMs open 📩. Reshares 🔁 appreciated 🙏

[Rado RC1 @RabbitPro]

@iamAlexGalvan We’re planning something special for this year! I’m sure you will like it. Watch this space or subscribe to our mailing list so you won’t miss it. 😎

[Rado RC1 @RabbitPro]

We can’t promise you will be able to jailbreak a F-35 but maybe at least you can find the 0day!

Last places to our flagship Hunting Zero-Days in Embedded Devices training! Unlock your potential.

https://t.co/T7GRj7uOGe

[Tom's Hardware @tomshardware]

Dutch Secretary of Defense threatens to 'jailbreak' nation's F-35 jet fighters — says it's just like jailbreaking an iPhone, in response to questions over software independence https://t.co/E4YVbJIKgu

[Rado RC1 @RabbitPro]

@nmatt0 xchg x0,x0

It’s yours now!

[Rado RC1 @RabbitPro]

@FuzzySec Oh wow! Keeping my fingers crossed for your new quests!

[Rado RC1 @RabbitPro]

We are returning with our training to Offensivecon 2026. This time tickets can also be purchased with a conference access bundle. Don’t wait. This will most likely be our only training for 2026.

[offensivecon @offensive_con]

🚨 In 2026, Pedro Ribeiro (@pedrib1337) and Radek Domanski (@RabbitPro) return to OffensiveCon with a training on "Hunting Zero-Days in Embedded Devices".

☝️Learn to identify and exploit vulnerabilities in embedded devices like routers, cameras, and microcontrollers through hands-on training in debugging, firmware extraction, and exploitation techniques for ARM and MIPS architecture. This training equips you with skills to uncover zero-day vulnerabilities through in-depth study and practical exercises on various vulnerabilities across different CPU architectures. Whether you're interested in hacking embedded devices or enhancing security testing, this training bridges hardware hacking and exploitation, preparing you for expertise in security, reverse engineering, or vulnerability research. Find more details here🔗https://t.co/u0NtbIbwTp

🚀 Don't miss this chance to improve your skills—sign up now!