anti00te

Better to light 🕯️ up than to shine 💎.

[Organized Crime and Corruption Reporting Project @OCCRP]

Morocco’s government has long denied using the Israeli spyware Pegasus to surveil its citizens. Now, a former Moroccan intelligence officer has detailed how Morocco’s domestic intelligence agency used Pegasus to spy on a journalist.

The whistleblower said Morocco’s intelligence agency avoided creating a paper trail tying it to Pegasus by procuring the spyware via a private intermediary company – a tactic confirmed by a second intelligence source.

Read our investigation with @FbdnStories: https://t.co/rf7nnxWMBE

[Organized Crime and Corruption Reporting Project @OCCRP]

JUST OUT: 🔴 A 'European' Password Manager’s Russian Origins

Read more in OCCRP Weekly, our flagship email newsletter on the latest in organized crime and corruption: https://t.co/snk4Sc2iCL

Subscribe: https://t.co/a0oYFqcEID

[Paul Moore - Security Consultant  @Paul_Reviews]

Bypassing the latest #EU #ageVerification app (2026.07-1) with a Chrome extension... again.

Despite 3 months of security hardening and genuine improvements across the board, the fundamental issue cannot be solved.

Anonymous age verification doesn't work.

[Shodan @shodanhq]

New release of Shodan Terminal (0.13.1) that includes various quality of life improvements and shows account status information if you're getting close to the usage limit. Now also available as an .msi package: https://t.co/IuqO5QdjQG

[Bloomberg @business]

Signal President Meredith Whittaker threatens again to pull the encrypted messaging app out of the UK

She tells @MishalHusain why Keir Starmer's approach to phone screening could usher in "mass surveillance" https://t.co/TKxYzfhu7O

[FOFA @fofabot]

⚠️⚠️ CVE-2026-50751 (CVSS 9.3): Deprecated IKEv1 Remote/Mobile Access certificate validation flaw may let unauthenticated attackers bypass VPN authentication (active exploitation reported).
🔗FOFA Link: https://t.co/oeIMCVgWTT
🎯34.8K+ Results are found on https://t.co/HSOBZfC2cT in the past year.
FOFA Query: app="Check_Point-SSL-Network-Extender"
🔖Refer: https://t.co/gG5v8QSqNC
#OSINT #FOFA #CyberSecurity #Vulnerability

[Shodan @shodanhq]

We offer a free and simple API endpoint to grab all the hostnames for a domain based on the certificate transparency logs: https://t.co/xAuMunXvYM

Sample Python code available in the Shodan book: https://t.co/36mxTrS2QS

[anti00te @anti00te]

@vxunderground 60 min is practically a lifetime in "0-day years" 😂. Can't say MSRC really earned the grace period, but good on the researcher for taking pity and at least dropping a warning before hitting publish.

[anti00te @anti00te]

@Ced_haurus @CNIL Ah, la fameuse logique du "il a cliqué donc c'est légal". À ce compte-là, les concepteurs de malwares et de stealers de cookies n'ont plus qu'à afficher un pop-up "En cliquant ici, vous acceptez qu'on récupère votre session" pour être en parfaite conformité. Pratique !

[Josh Rogin @joshrogin]

This is a phishing attempt. If you get this message on Signal, do not follow the instructions. Many anti-CCP activists have also received this phishing attempt. Beware and be aware.

[𝚔𝚒𝚖𝚖𝚢.𝚣𝚒𝚙 🅅 👊🇺🇸🔥 @kimmydotzip]

For the record, I'm actually a fan of CVD, and have participated in it multiple times during my tenure at Qualys.

But you DO NOT get to force us to participate in your CVD / bounty program by threatening to call the people with guns if we don't.

FUCK YOU, @msftsecresponse.

[MalwareHunterTeam @malwrhunterteam]

🤷‍♂️

[bohops @bohops]

Of all the frustrating experiences I’ve had with MSRC, the ones like @GabrielLandau ’s were by far the worst.

These days, I only report bugs when there’s a genuinely compelling reason, and those reasons are finite. Otherwise, I’m perfectly happy sitting on my 0-days for another time.

[anti00te @anti00te]

Public disclosure is free speech. Writing and publishing code, even exploit code is research and education. Exposing a flaw in software we bought doesn't make researchers criminals, the company that left the door unlocked is at fault.
#FixYourCode, #FixYourSystem, instead of punishing those who find them! @Microsoft @msftsecurity @MSFT

[Christopher | 🇺🇦  @d4rkshell]

Microsoft has banned Nightmare Eclipse from GitHub: https://t.co/EmeiJnJ0Ps

This is the researcher who disclosed several zero-days after Microsoft also deleted their MSRC account.

They have now moved on to GitLab: https://t.co/Npj0gplSum

(h/t to: @[email protected])

[Mullvad.net @mullvadnet]

A new VPN leak that allows any app to leak traffic outside the VPN tunnel has recently been discovered by @cybaqkebm

Read more here: https://t.co/K9bxtiGHbw

[anti00te @anti00te]

@H4ckmanac Old topic; nothing new here.

[anti00te @anti00te]

Great job👌keep up the fight!💪

[Recorded Future @RecordedFuture]

Recorded Future has been named a Leader in the inaugural Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies. Gartner analysts analyzed 17 vendors on their ability to execute and completeness of vision.

Get the report: https://t.co/nAaojWj13U

[impulsive @weezerOSINT]

North Korean Lazarus Group has weaponized this exact class of Microsoft-signed kernel driver.
It is sitting on MILLIONS of Windows PCs right now.
It gives any local process full control from the deepest level of Windows.

5 lines of code. Zero validation.
Your antivirus can’t stop what runs below the OS.

[International Cyber Digest @IntCyberDigest]

❗️🇫🇷 Following the French government's ban on Windows and its replacement with Linux, French activists are now saying goodbye to Windows 10 and actively encouraging people to embrace freedom and use Linux instead of paying for an upgrade to Windows 11, citing privacy concerns.