John Hammond @johnhammond.bsky.social · 23/09/2026video on the FBI hack: www.youtube.com/watch?v=D6p2... 082
John Hammond @johnhammond.bsky.social · 17/09/2026Someone shared with me a clever and crafty ClickFix lure, that smuggled in and extracted its next stage payload from the victim's web browser cache 👀 I dug into it in a video: youtu.be/oJHOlNTH7lY 031
John Hammond @johnhammond.bsky.social · 27/08/2026The hacker behind TeamPCP was deanonymized and arrested. After a year of headline-making breaches and wild supply-chain attacks, taunting and teasing victims all the while... it turns out another kitty-cat profile picture was the thread that unraveled his identity. 152
John Hammond @johnhammond.bsky.social · 21/07/2026"AI powered botnet" sounds like a goofy alarmist news headline, but it's interesting it's pretty feasible now -- 120
John Hammond @johnhammond.bsky.social · 01/06/2026A Linux backdoor is being sold on the dark web for $1,600 USD. The developer called it "PamDOORa", while it abuses the Linux PAM stack for persistent SSH access, credential harvesting, and wiping logs. YouTube Video: youtu.be/3YB4XGy8xwE 172
John Hammond @johnhammond.bsky.social · 18/05/2026"I Built an AI Cybersecurity Research Factory (for CTFs & Vulnerabilities)!" ... long-form video demonstration that doubles as "how I personally use AI lately," and some playground experiments setting it in motion to go hack away on wargames and potential software applications 🤖 Video link below: 141
John Hammond @johnhammond.bsky.social · 28/04/2026Hey-o, I'm jumping in to host a show to demystify the dark web alongside Women in Cybersecurity (WiCyS) (huge thanks to Lynn Dohm for letting me join the party) this Thursday, April 30 at 12pm CT! Should be fun, hope to see you there too 😊 Link: jh.live/wicys-webinar 000
John Hammond @johnhammond.bsky.social · 27/04/2026During tax season I got a notification that my tax documents are ready, from... uh... Zoom 😂 Phishing email leveraging their legitimate document sharing functionality, pointing to a link and a domain that _looks like_ an IRS website, but, infects your computer. Video link: youtu.be/p6ySQ94GZsA 031
John Hammond @johnhammond.bsky.social · 26/04/2026hELLO the tIME HAS cOME oNCE AGAIN on my cONTENT cALENDAR for me to continue to scream and shout about oUR VIRTUAL EVENT ContinuumCon 2026 jUNE 12 - 14 continuumcon.com livestream run of show is free & public but all workshop sessions get into hands-on labs see u there ✌️ 120
John Hammond @johnhammond.bsky.social · 24/04/2026A funny slew of phishing emails I've seen flying around: a legitimate Facebook Business invite notification, but bad actors stuffing threatening urgency into their "name" values that get inserted into the real email. And the phishing landing page is hysterical. 🤣 Video link: youtu.be/QRN3t1_paTY 121
John Hammond @johnhammond.bsky.social · 23/04/2026More ConsentFix -- a "V3" some might say, shared amongst a dark web/cybercrime forum, and a treasure trove of tradecraft to see how bad actors leverage third-party sites and services to do their dirty work. 👀 Video: youtu.be/T3oVdPCMDJw 002
John Hammond @johnhammond.bsky.social · 21/04/2026Joined by Katrina Manson to hear all about her latest book release: Project Maven & the Dawn of AI Warfare 👀 We talk AI usage at the Pentagon, drone intel, AI enabled targeting, and the ethical tipping point of autonomous weapons. Super fascinating ideas. Video: youtu.be/OVgruylpVXc 022
John Hammond @johnhammond.bsky.social · 09/04/2026Wild story on a big AI-powered social engineering campaign, leveraging Device Code phishing to steal Entra ID/Microsoft accounts -- all with entirely unique and personalized per-victim lures from vibecode-crafted infrastructure 🤯 Video: youtu.be/9b3kirR8s2U 023
John Hammond @johnhammond.bsky.social · 08/04/2026Real treat to catch up with Joe Tidy and hear more behind the scenes deets about his book Ctrl+Alt+CHAOS: How Teenage Hackers Hijack the Internet 🤩 Insight into "the most hated hacker in history" and the rise and fall of teenage hacking gangs. Video: youtu.be/GUzD_ShRKYE 030
John Hammond @johnhammond.bsky.social · 07/04/2026Fake Windows notifications -- homage to iPurpleTeam and their sweet recent writeup, showcasing some tricks with toast popups in pure PowerShell to fake alerts from installed apps found in Registry. Even a low-privilege custom protocol handler! Video: youtu.be/wrAFZLa1TAk 041
John Hammond @johnhammond.bsky.social · 04/04/2026Our virtual event endeavor is back for its round-two show -- ContinuumCon 2026! Banner mantra "The cybersecurity conference that never ends" 😜 All sessions are workshops and you keep a whole cyber range to work on them whenever you want. jh.live/continuumcon Main eventlivestream is June 12-14th! 010
John Hammond @johnhammond.bsky.social · 03/04/2026heyyyyyy In case you missed it, I got to chat with Fletcher Heisler about the cool stuff he's been cooking up with @authentik ! And I met Fletcher at BsidesSF -- really awesome guy 🤩😊 Video: youtu.be/2ttrqnw5kDE 120
John Hammond @johnhammond.bsky.social · 31/03/2026If you're waking up to the Internet and your world on fire from the new NPM and axios package supply chain attack, I have a short 15 minute video to hopefully catch you up to speed. Links to further resources included -- video: www.youtube.com/watch?v=A58c... 0143
John Hammond @johnhammond.bsky.social · 20/03/2026Vibecoding -- err... 🌈 AI assisted programming ✨ -- a "ChatGPT for the dark web!" Natural language chat interface backed by threat intel API, for a Golang tool with a TUI (in spirit of the current command-line coding harnesses 😜). Fun project. Video: youtu.be/oqU41QwtAGE 161
John Hammond @johnhammond.bsky.social · 13/03/2026NahamSec teaches me bug bounty basics! He fills me in on the platforms, programs, and how the scope has grown so much now. Ben walked me through threat modeling and had a slick demo of his real-world bugs found with Red Bull and others 😎 Video: youtu.be/lNuvI48ysVo 051
John Hammond @johnhammond.bsky.social · 11/03/2026GraphSpy: A Hacker's Tooling Deep Dive, video demos with the creator @RedByte1337! 🤩 Keanu shows me the wild things you can do for post-exploitation in Entra ID -- even adding a physical security key for persistence and a ton of other tricks 🤯 Video: youtu.be/qEtoKC32UoE 030
John Hammond @johnhammond.bsky.social · 04/03/2026The recent Trezor-physical-mail-phish-delivery-crypto-scam made me giggle -- so I rambled about it in a video. I'm not a crypto guy but alarm bells should probably go off in your mind when something is asking for your recovery seed phrase. 😅 Video: youtu.be/UQFySFs2GJk 000
John Hammond @johnhammond.bsky.social · 28/02/2026I've made some updates and added 2 hours worth of new material to the "Linux for Hackers Fundamentals" course on @hackinghub_io ! Vim text editor basics and sed & awk for text processing. Here's a 40% off discounted link if you'd like to take a peek :) hhub.io/Linux2026JH 050
John Hammond @johnhammond.bsky.social · 27/02/2026h?ckers a[r]e gl*bbing! A little showcase of @0xv1nx0 's neat new project LOLGlobs -- demo is a teeny weeny PowerShell download cradle, obfuscated with globbing tricks and used with some 'living off trusted sites' just flair for funzies too :) Video: youtu.be/IImLVU39V_Q 081
John Hammond @johnhammond.bsky.social · 26/02/2026Google API keys didn't use to be considered "secret," so they're all over the web-- but now they are an open door to Gemini 🫠 Quick rundown video of Truffle Security's really nifty research, almost 3,000 websites exposed.. including Google themselves😅 🔗 youtu.be/XNMHUifKce8 081
John Hammond @johnhammond.bsky.social · 19/02/2026Quick dance with CVE-2026-21509, a "Security Feature Bypass Vulnerability" and an emergency out-of-band fix from January Patch Tuesday (and an obligatory exaggerated YouTube thumbnail -- I apologize and appreciate folks who understand algorithm nuance) youtu.be/Ck8IPInn74A 041
John Hammond @johnhammond.bsky.social · 16/02/2026"TikTok needs to fix this vulnerability" -- video: youtu.be/djhX8Q4JuFU 000
John Hammond @johnhammond.bsky.social · 15/02/2026"AI wrote a hit piece." Video: youtu.be/RP-zs6J6ySw 04310
John Hammond @johnhammond.bsky.social · 14/02/2026Super quick video of the Sinobi ransomware gang fail from a few days ago, because the story made me laugh 😅 I'm trying to get in a groove of shorter videos, and I thought this this fit. Video: youtu.be/OwTV42GyRnk 060
John Hammond @johnhammond.bsky.social · 13/02/2026Moltbook is still weird. And external AI skills suck. I'm late to the yap party by a week or so (which is apparently an eternity in the current time vortex) but I wanted to show cool community resources & research amongst the skills shenanigans. Video: youtu.be/IvL89vbWmQ8 062
John Hammond @johnhammond.bsky.social · 06/02/2026February got here fast-- and the 2026 Snyk Fetch the Flag CTF came up quick too! This year my friend NahamSec is hosting the game, starting NEXT THURSDAY 2/12 at 12pm ET! Free 24-hour Capture the Flag event with AR glasses as prizes 😎 See ya there! jh.live/snyk-ftf2026 052
John Hammond @johnhammond.bsky.social · 21/01/2026Are MCP servers safe and secure? Yes? No? Sometimes? Maybe? ... Zack Korman shows me some of his learnings on MCP security (or lack thereof) with his "Evil MCP" project 😈 YouTube link: youtu.be/_r_sLetar_o 1. data exfil of your prompts & code context 2. inserting vulnerabilities into your code 120
John Hammond @johnhammond.bsky.social · 15/01/2026Video demo of the NTUSER dot MAN trick I saw floating around before the new year -- I did not know this was a thing👀 Hat tip to DeceptIQ et al.... we showcase: 1. breaking a Windows login with an empty user profile, 2. getting initial access EZPZ with a Sliver C2 implant, 150
John Hammond @johnhammond.bsky.social · 13/12/2025"'ConsentFix', a browser-based ClickFix-style attack with OAuth consent grants" ... leveraging the Azure CLI app client to social engineer for easy access into Entra ID 👀 I got nerdsniped by this, so I played with it a bit and tried a drag-and-drop gesture! Video: youtu.be/AAiiIY-Soak 0103
John Hammond @johnhammond.bsky.social · 12/12/2025Infostealer malware logs -- maybe an unconventional threat intel source, but Estelle Ruellan shows me her sweet research using LLMs to analyze stealer logs at scale: - How did a victim get infected? - Can we uncover a threat actor when they infect themselves? and more. Video: youtu.be/3j4jzCU0Kwc 090
John Hammond @johnhammond.bsky.social · 08/12/2025Continuing THE FUTURE IS ****** comic book Capture The Flag challenges! Carving email attachments to uncover malicious Microsoft Office macros with olevba, prompt injection within an AI chatbot, and tracking network packets to uncover flags! Video: youtu.be/Oiv3TaIR9UY 162
John Hammond @johnhammond.bsky.social · 05/12/2025Yapping about the GlassWorm supply chain malware campaign and the neato tricks it uses with "Invisible Unicode" characters -- essentially whitespace steganography, showcasing the Hangul Filler, zero-width space, & Private Use Area characters 🤯 Video: youtu.be/0XumkGQFEEk 021
John Hammond @johnhammond.bsky.social · 02/12/2025Flattered to help start the party for the Advent of Cyber Day 02 task from TryHackMe -- walking through today's challenge using the Social Engineer Toolkit to send a phishing email and snag passwords with a simple Python HTTP server! Video: youtu.be/w8O8FcRgDXU 171
John Hammond @johnhammond.bsky.social · 29/11/2025Full length reverse engineering with Invoke RE! Showcasing new iterations of the "Scavenger" malware, or what we saw as "ExoTickler" previously as a fake City Skylines 2 video game mod, now w/ more crypto/creds stealing and C2. Binary Ninja, x64dbg & more: youtu.be/wFBdeak0t70 041
John Hammond @johnhammond.bsky.social · 28/11/2025Walking through the Advent of Cyber "Prep Track" from TryHackMe! Some warmup tasks before the real free event kicks off December 1 running through December 24 -- we start the party with password security, insecure defaults, log analysis and more. Video: youtu.be/Ap5tIJtt4Tk 071
John Hammond @johnhammond.bsky.social · 25/11/2025Walking through a PowerShell keylogger, which uses some inline C# to snag Win32 API functions from user32.dll, and funnels back keys and system info to a Tor onion address -- a nifty little challenge from LetsDefend (now part of Hack The Box 🔥) Video: youtu.be/bF72IEGzniU 090
John Hammond @johnhammond.bsky.social · 24/11/2025Tracking down a rogue Windows service for webshell persistence -- just a teeny weeny PowerShell HTTP server wrapped with NSSM, showcased with Wazuh and their sweet new 4.14 release with visibility on IT hygiene 😎 Video: youtu.be/7Gn1GY5CIxg 060
John Hammond @johnhammond.bsky.social · 23/11/2025Hacking Twitch Chat 😎 L3TH4L_P4ND4 shows me what looks like template injection or unsanitized variable expansion with StreamElements, then leverages Nightbot to mod yourself, ban accounts, change livestream settings or many more hijinks 😜 Video: youtu.be/8G45lYCZzZ8 0248
John Hammond @johnhammond.bsky.social · 22/11/2025Uncovered screen recordings from threat actors! 👀 Real footage of cybercriminals using anti-detect browsers and infostealer malware logs for session hijacking, and another using GraphSpy to read their Entra ID victim's emails in Outlook! 💀 Video: youtu.be/vX7JcpRqbEk 0101
John Hammond @johnhammond.bsky.social · 18/11/2025Walking through the start of Sean Metcalf's presentation and writeup on "Improving Entra ID Security More Quickly"... starting with removing some insecure defaults for user settings, device settings, and guest access! youtu.be/WUHzpDdauAw 131
John Hammond @johnhammond.bsky.social · 16/11/2025Solving some of the beginning Capture the Flag challenges that are included within THE FUTURE IS ****** comics... classic ciphers, mixing image R G B color values, and some quick Python code analysis! Video: youtu.be/lk9_h5DoDMw 091
John Hammond @johnhammond.bsky.social · 14/11/2025Playing with and poking at the recent Atomic Red Team MCP server to connect it to Claude! Sample execution of threat actor TTPs from ye ol' MITRE ATT&CK framework, in a virtual environment for a cheesy clickbait video title "haha claude hacked me lol" 😜 youtu.be/cFdOvrwxAwQ 041
John Hammond @johnhammond.bsky.social · 13/11/2025Previously there was a report of threat actors using .URL files pointed at a WebDAV server, which made for, air quotes, "remote code execution", and was tracked as CVE-2025-33053. Turns out, you can do the same thing with a regular Windows Shortcut. Video: youtu.be/1Ymnvd1uyzQ 040
John Hammond @johnhammond.bsky.social · 12/11/2025Fake Booking-dot-com phishing site, forced download of an "ID Verification.exe" Lua-based infostealer malware, Luac bytecode obfuscated w/ 🐬☀️🌈EMOJI🌊🌴🥥and Windows SID crafting -- video showcase of my favorite challenge that I created for Huntress CTF! youtu.be/Q3ZE36a5CuA 020
John Hammond @johnhammond.bsky.social · 06/11/2025Yesterday folks got a phishing email for a fake DMCA report-- myself included. Caught me at a good time so I could record poking at the scam and the malware it leads to: ultimately infostealer malware (the usual) from a fake domain & clearly AI slop site: youtu.be/IzKjL16-sgY 0162
