Jacob Krell

Cybersec/AI expert | Hacker | Pilot | Lifter | OSCE3, CISSP, CCNP, CSIE | Top 20 Hack the Box | CTF Reviews and Writeups | meme magic 🐸

[Jacob Krell @hackerfren]

I am currently building out a Virtual Chief Privacy Officer service line for my company.

To that end, I recently passed the IAPP Certified Information Privacy Manager (CIPM) certification.

Just finished the review for it which you can view on my personal website: https://t.co/IXCuC5c39e

[Jacob Krell @hackerfren]

@vxunderground

[Jacob Krell @hackerfren]

@vxunderground literally more effort into persecuting the guy then thy spent in Q&A security testing.

[Jacob Krell @hackerfren]

@rootsecdev Its okay they only made $281.72 billion last year in revenue.

what do you want from them? they need to pay all their sales and marketing people somehow!

[Jacob Krell @hackerfren]

@Teach2Breach Those m4 mac minis have been calling my name.......

[Jacob Krell @hackerfren]

Lets just say....

in about 4 hrs a couple days ago I used Opus 4.6 on Cursor, plain, to make a Sliver MCP through which the agent created Evasive payloads and was executing commands across multiple hosts at once, doing persistence etc.....

Defender is basically worthless nowadays....

First thing I have done I'm actually debating whether i can publish or not....

And it took a couple hours and extremely little thinking. Straight up just had it do web research into the latest evasive techniques...

[Jacob Krell @hackerfren]

@Teach2Breach Oh and defender is trivial to bypass. With opus 4.6…..
That’s an entire separate issue though…..

[Jacob Krell @hackerfren]

@Teach2Breach Meanwhile windows 11 barely works.

Every single day I have os level issues with heavy agentic ai loads and async issues with one drive crashing explorer.

[Jacob Krell @hackerfren]

@vxunderground The future of marketing

[Jacob Krell @hackerfren]

Supply chain and dev tool compromises continue to be in the news week after week. Its becoming a question of when, not if. Vendor risk management is more important then ever as threat actors continue to move up the chain.

[Suzu Labs @SuzuLabs]

GitHub just confirmed that 3,800 internal repositories were stolen… through a single VS Code extension.

Not a zero-day.
Not ransomware.
A developer plugin.

This is TeamPCP’s FIFTH supply chain compromise in ~3 months, and it highlights a massive blind spot most organizations still ignore: IDE security.

Most companies heavily govern:
✅ SaaS apps
✅ Cloud infrastructure
✅ Production environments

…but allow developers to install extensions with virtually unrestricted access to:
⚠️ source code
⚠️ credentials
⚠️ cloud tokens
⚠️ local systems

The attack surface has officially moved upstream, into the tools used to WRITE the code.

If your organization hasn’t started governing developer tooling, extension usage, and workstation trust boundaries, now is the time.

The GitHub breach wasn’t the anomaly.
It was the warning shot.

Read @jacob krells latest research here: https://t.co/1pRIAqmMc9

#CyberSecurity #SupplyChainSecurity #DevSecOps #VSCode #GitHub #SoftwareSecurity #ThreatIntelligence #Infosec

[Jacob Krell @hackerfren]

@rekdt The average exploit timeline is negative 7 days.

On average patching isn’t even helping based on real world IR data…..

The issue is the dwell times. We need ai threat hunting……

[Jacob Krell @hackerfren]

@vxunderground @GrahamHelton3 And most companies still can’t even tell you all their 3rd party vendors or give a BoM for their products/ software…..

[Jacob Krell @hackerfren]

@yacineMTB The hard part is selling.

With ai dev, bro, you can make an entire enterprise product in like a week if you know what your making.

[Jacob Krell @hackerfren]

@HackingLZ Who needs to evade detection when you are just hijacking the supply chain

[Jacob Krell @hackerfren]

@UK_Daniel_Card Nice! St. Peter’s is unreal.

Awesome in the truest sense of the word in my experience.

[Jacob Krell @hackerfren]

@L0rd5ud0 It made my day I’m famous hahaha

[Jacob Krell @hackerfren]

I was quoted in Forbes, that's pretty cool!

Microsoft does not seem to be having a good 2026 so far security wise, with Exchange being the most recent issue in the crosshairs:

...“attackers study mitigation guidance the same way defenders do,” meaning that such vulnerabilities can be turned into working exploits “much faster than most organizations can validate exposure.”'...

https://t.co/nJpDAbH2D4