Joe

Hacker, Cybersecurity leader, writer, world traveler, and #Bitcoin HODLer

[Nicolas Krassas @Dinosn]

Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest https://t.co/BkwoSBEFew

[r0BIT @0xr0BIT]

shipping: WinSSHound

maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.

https://t.co/ONXuguz7r3

[曾哥 @AabyssZG]

HashDump-BypassEDR：https://t.co/oa8qQcuUd1
通过系统白程序 Reg.exe 的拓展应用，巧妙绕过EDR的拦截点，实现绕过EDR从而DumpHash😈
该方法针对Windows系列均有效，操作难度不大，具有实战价值🥳
本项目实战文章：https://t.co/IcjVWYtjBY
源代码和Release已发布，师傅们麻烦点个Star，万分感谢！😍

[The Hacker News @TheHackersNews]

🚨 WARNING: A malicious Hugging Face repository impersonating #OpenAI’s Privacy Filter model reached #1 trending with about 244,000 downloads in 18 hours while delivering a Rust-based infostealer to Windows users.

Read: https://t.co/VFuIgbu3EI

[bugcrowd @Bugcrowd]

Popping alert(1) doesn't show REAL impact.

Escalate your XSS by stealing cookies instead👇

Better XSS escalation paths here: https://t.co/aQoQJrGDyf

[The Hacker News @TheHackersNews]

🛑 WARNING: Bitwarden CLI was compromised in a supply chain attack.

@bitwarden/[email protected] included malicious code after attackers hijacked GitHub Actions, stole secrets, and pushed a tampered version to npm.

🔗 Learn how the attack worked → https://t.co/xqqJ7a9REL

[Isaiah Douglass ⚡️ @IDFinancial]

Every time Bitcoin has recovered 30% from a cycle low, it has never revisited that low. 6 for 6 across 13+ years.

The YTD low of $61,303 (https://t.co/1wyVmU4A1W) to today's ~$79K is a +28.9% recovery. The +30% confirmation level sits at $79,694.

We're at the doorstep.

[Hacking Articles @hackinarticles]

🔴 File Upload Bypass Cheat Sheet (Extension Splitting)

Credit @therceman

If you're testing file upload functionality, this is pure gold 🔥

Attackers don’t just upload shell.php… they play with encoding, null bytes, separators, and edge-case parsing tricks to bypass filters.

💡 Common tricks:
• Double extensions (.php.png)
• Encoded characters (%0a, %00, %23)
• Unicode bypasses
• Special chars & separators
• Tabs / Newlines injection
🎯 Lesson:
If your validation relies ONLY on extension checks → it's already broken.
🧠 Think like an attacker. Validate like a defender.
#bugbounty #cybersecurity #pentesting #infosec #websecurity #ethicalhacking #redteam

[Joe @_joemarty_]

@ColinTCrypto At what point would you concede you're wrong, and the bottom truly hit already? Where would you resume buying if it never dips below $60k/BTC ever again? 📈🤔

[TFTC @TFTC21]

A security researcher just documented a large-scale counterfeit Ledger Nano S Plus operation selling compromised devices across multiple online marketplaces.

The fake units look identical to the real thing but contain completely different hardware. Instead of Ledger's secure element chip, the counterfeits run an ESP32 microcontroller with modified firmware labeled "Nano S+ V2.1." Seeds and PINs are stored in plain text and transmitted to attacker-controlled servers. Any wallet initialized on the device is drained.

The operation goes beyond the hardware. The sellers also distribute a fake version of Ledger Live built with React Native and signed with a debug certificate. It intercepts transactions and exfiltrates sensitive data to multiple command-and-control servers. The campaign spans five attack vectors: compromised hardware, Android APKs, Windows executables, macOS installers, and iOS apps distributed through TestFlight to bypass App Store review.

This comes days after ZachXBT documented a separate fake Ledger Live app that made it through Apple's Mac App Store review process. That operation drained over $9.5 million from more than 50 victims, including musician G. Love, who lost 5.92 BTC after entering his recovery phrase into what he believed was the legitimate app.

The pattern is clear: the attack surface for hardware wallet users has shifted from firmware exploits to supply chain and distribution fraud. The devices themselves remain secure. The problem is that users are being intercepted before they ever touch a real one.

Ledger's own "genuine check" feature can be bypassed when the hardware itself is compromised at the source, which makes where you buy the device as important as how you use it.

The rules haven't changed, but they've never been more important: buy hardware wallets only from the manufacturer. Never enter your recovery phrase into any software. If a companion app asks for your 24 words on a screen, it's a scam. Every time.

[incursion @Incursi0n]

Made a quick BOF to exploit the currently unpatched BlueHammer vulnerability to dump SAM hashes from a low integrity context.

https://t.co/0AqFwHpQ9f

[vx-underground @vxunderground]

Another zero day exploit released by some nerd (can't remember name right now) because they're annoyed with Microsoft. It's been confirmed by other nerds. It is yet another legit zero day. Whew.

https://t.co/Zllhns1ztn

[Joe @_joemarty_]

So, reincarnation takes around 354 days🤔 because I'm pretty confident that @naval Ravikant is our modern day Alan Watts🧘🏾‍♂️
and I'm grateful for the wisdom from both🙏🏼

[Joe @_joemarty_]

@TFTC21 @Bitkey I would like one, please 🙏
✅Pre-requisites met.

[TFTC @TFTC21]

Giving away another @Bitkey hardware wallet! 🟠

Follow Bitkey and us, RT to enter. ✅

Winner announced Tuesday, 4/21 at 4PM EST.

[The Hacker News @TheHackersNews]

🛑 Adobe released emergency fixes for a 9.6 CVSS flaw (CVE-2026-34621) in Acrobat/Reader, confirmed under active exploitation.

A prototype pollution bug lets malicious PDFs run arbitrary code via JavaScript. Evidence shows attacks may date back to Dec 2025.

🔗 Read → https://t.co/y0BJMEd2ly

[The Hacker News @TheHackersNews]

🔥 Google rolled out Device Bound Session Credentials (DBSC) in Chrome 146 (Windows).

It ties session cookies to a device using hardware keys, so stolen cookies can’t be reused without that device. Cookies expire quickly without validation.

🔗 Read → https://t.co/5mrJEMFBJt

[Joe @_joemarty_]

💯 Any argument for more federal funding = arguing for either more inflation or more aggression by your govt against yourself, your family, your friends, and your fellow citizens. That is the only 2 ways the federal govt. can provide funding: inflation or extortion (i.e., threatening violence/imprisonment if you don't pay them more).

[obscaries ❘ AppSec @obscaries]

Still writing long commands manually during recon? 😩

Here’s a hidden gem 👇
https://t.co/MZKdK9iLqa

A solid collection of bug bounty one-liners for recon, enumeration & automation, save time and move faster ⚡

Work smarter, not harder.

#BugBounty #CyberSecurity #InfoSec #Recon

[CR1337 @CR1337]

It is 2026, your personal data is the oil of the 21st century & Big Tech wants to own it all!

But will you let them?!

Here are 10 privacy-first self-hosted tools that give you full control: no accounts, no tracking, no nonsense.

All open-source. All runnable on your own hardware:

1. Nextcloud: Google Drive alternative + office suite. Files, calendars, contacts,.. all encrypted and under your roof:
https://t.co/SkqwzCehTy

2. Vaultwarden (Bitwarden self-hosted): Password manager, running on your server. End-to-end encrypted, zero trust in third parties:
https://t.co/odsCW8FSIX

3. SearXNG: Meta-search engine that doesn’t profile you. Host it yourself and ditch Google’s surveillance completely:
https://t.co/BVTO5PNeuy

4. Syncthing: Private file sync that beats Dropbox. Peer-to-peer, encrypted, works offline. Your files never leave your device(s):
https://t.co/iv8qsVxGeE

5. Umami: Lightweight, privacy-first Google Analytics alternative. Beautiful dashboards, no cookies, self-hosted in minutes:
https://t.co/trunm87ouz

6. Jellyfin: Your personal Netflix. Stream your movies & TV with full metadata, no subscriptions, no tracking of what you watch:
https://t.co/e2aqMQEEsH

7. CrowdSec: Collaborative firewall that learns from millions of users. Bans bad actors automatically; smarter than Fail2Ban:
https://t.co/JeDrmkhnsB

8. Immich: Self-hosted Google Photos replacement. AI photo search, facial recognition, backups; all on your hardware:
https://t.co/kKxmazaCs7

9. Portmaster: The ultimate app firewall. See exactly where every program on your computer is trying to connect and block it if you want to:
https://t.co/9NiacPK6ZD

All of these are free, open-source, and can be run on a cheap mini-PC, old laptop, or even a Raspberry Pi!