iiinova — where your digital self keeps evolving

Mythos 5.1 review after having used it for exploit dev: Is the the best at surfacing new vulns and chaining exploits? YES Is it economical? NO it literally would cost more than paying people to do the work by hand by an order of magnitude unless you get really lucky. Nothing special. Heap of shit..

000

Nad @nadsec.online · 07/10/2026

Dey gib me angry robot

010

Nad @nadsec.online · 02/10/2026

Which ever country made this junk malware.. Ya'll should be ashamed. 4/10 only cause it does actually work and somehow evades EDR.. Whichever EDR vendor this was, just don't. Don't anymore. www.nadsec.online/blog/majlis-...

nadsec.online

Majlis 2026 Invitation RAT: OTP 123456 and a Snowy Village | NadSec

Robert pulls apart the Majlis 2026 invitation RAT: a WebDAV and FTP delivery chain, two command channels, nine tested commands, a screenshot bug, and one deeply unhelpful holiday photo.

010

Nad @nadsec.online · 29/09/2026

Filippo Valsorda is a household name!

011

Nad @nadsec.online · 29/09/2026

Thank goodness hitachi is on the list! My important tools are safe 👀

000

Nad @nadsec.online · 27/09/2026

Sandwhich > Sandbox

000

Nad @nadsec.online · 27/09/2026

There it is.. one day ppl gonna listen to me 🤣🤣🤣🤣

010

Nad @nadsec.online · 26/09/2026

Found dupe glitch in an gringo currency type web3 type bs thing. The robot out here printing it's own money.

010

Nad @nadsec.online · 25/09/2026

I miss asking people for directions

000

Nad @nadsec.online · 18/09/2026

Yeaa but I reckon another to come potentially..

000

Nad @nadsec.online · 15/09/2026

As a vegan whom juices their own phat nuts to put in my covfefe I can get behind this.

000

Nad @nadsec.online · 14/09/2026

If Claude was a person, he’d be riding a Surron electric motorcycle through a school zone at 150kmph at 3PM on a weekday.

010

Nad @nadsec.online · 13/09/2026

Switzerland ain't playin!

000

Nad @nadsec.online · 09/09/2026

New Cisco zero day finna drop in the next month. Gonna start being used for in the wild exploitation in 2 weeks and will be publically disclosed within 2-3 weeks following. Good luck out there.

121

Nad @nadsec.online · 08/09/2026

Watching botnets smack my honeypot infra is pure art. Unfiltered, aggressive, unrelenting yet beautifully creative. The chaos of human intent encapsulated in automated fighting robots. A digital terrarium of nerds wading through a sea of shit nobody asked for, simply because they can.

011

Nad @nadsec.online · 03/09/2026

“The Epstein files?? People are still talking about the Epstein files?” - Donald

010

Nad @nadsec.online · 13/08/2026

CVE-2026-66804 - Windows Cross Device Service LPE - Writeup & PoC Found another cool one! www.nadsec.online/blog/cve-202... Not sure who found it first, but shoutout to them. Despite not being FTF, my mom thinks this one is cool, which is the only important metric 😎

nadsec.online

CVE-2026-66804: Cross Device Virtual Camera to SYSTEM | NadSec

A missing ProgramData COM path lets a standard user plant the Cross Device virtual-camera DLL, reach LOCAL SERVICE, and obtain SYSTEM.

021

Reposted by Nad

Catalin Cimpanu @campuscodi.risky.biz · 04/08/2026

Also this: www.artsprofessional.co.uk/news/breakin... And this: www.cse.org.uk/news/beacon-...

021

Nad @nadsec.online · 28/07/2026

(I'll get it working on iPhone again tomorrow)

000

Nad @nadsec.online · 28/07/2026

I like this one :) github.com/Rat5ak/fried... Try it out for yourself: friedbrowser.com -disclaimer, this will crash your browser and likely cause your phone to heat up for a significant period of time before crashing the device.

github.com

GitHub - Rat5ak/friedbrowser: WebGL 2 UBO browser denial-of-service research

WebGL 2 UBO browser denial-of-service research. Contribute to Rat5ak/friedbrowser development by creating an account on GitHub.

100

Nad @nadsec.online · 18/07/2026

“How is this guy so productive, and why does nothing work” …. Oohhhhh

020

Nad @nadsec.online · 18/07/2026

I’m hoping they install webcam monitoring software so they can see me kicked back with sunnies on, feet on the desk with my agents running on my corporate laptop.

120

Nad @nadsec.online · 16/07/2026

CVE-2026-50343 - InstallService Windows local privilege Escelation - Writeup and POC Found another cool one! www.nadsec.online/blog/cve-202... Not sure who first to find was, but shoutout to them. Despite not being FTF, my mom thinks it's cool and that's all that matters 😎

nadsec.online

CVE-2026-50343: InstallService StaticPluginMap to SYSTEM | NadSec

A standard user controls plugin state consumed by Microsoft InstallService, then uses a public WinRT trigger to reach SYSTEM DLL loading.

012

Reposted by Nad

Catalin Cimpanu @campuscodi.risky.biz · 12/07/2026

No. I did it. That's why I took next week off from work

1182

Nad @nadsec.online · 08/07/2026

I’m so 30 that I’ve started drinking oat milk in my coffee. I didn’t sign up for this.

010

Nad @nadsec.online · 04/07/2026

July 2026 update.. Hoverboards nowhere to be seen. Snake still un-oiled.

010

Nad @nadsec.online · 15/06/2026

Linus Torvalds is the original vibe coder. That guy's been vibe coding for atleast a decade. Legit, he been prompting humans this whole time. Barely writes any code himself. Crazy

111

Nad @nadsec.online · 15/06/2026

Not sure how it would be different tho from what ur running, maybe you need to add more lists on the pihole

000

Nad @nadsec.online · 15/06/2026

U block extension? Although I believe that now probably has the same adtracking lists as ur running on pi hole and I think it only does dns level stuff now too.. I have UniFi router that does blocking and have a seperate vpn client installed that also does it. I really don’t see any ads

100