Sign in

Ian Campbell

@neurovagrant.bsky.social
418 followers 285 following 1.2K posts

Security ops engineer and investigator @ DomainTools, writer, voracious reader. he/him. Opinions here mine only. Autistic/depressed/anxious/hungry. dti.domaintools.com

PostsRepliesMedia
Reposted by Ian Campbell
Wolfie Christl @wchr.bsky.social · 02/10/2026
The web and mobile apps of major conversational AI engines transmit prompts, titles and conversation permalinks to advertising data firms, alongside device IDs, hashed email and other persistent identifiers. Comprehensive analysis, like always from this team: jorgegarciaherrero.com/wp-content/i...
22924
Ian Campbell @neurovagrant.bsky.social · 03/10/2026
Reuters: ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say #cybersecurity #infosec www.reuters.com/world/middle...
reuters.com
EXCLUSIVE: ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say
A suspected member of the ShinyHunters hacking group, which ​says it stole data on every FBI employee, was detained in Jordan this week and is cooperating with the FBI, three people familiar with the ...
063
Ian Campbell @neurovagrant.bsky.social · 03/10/2026
tumblr post from e-seal: Necromancer that doesn't know they're a necromancer and thinks they're just a really good EMT.

Reply from raimagnolia: That is the funniest thing I have ever read.
021
Ian Campbell @neurovagrant.bsky.social · 03/10/2026
I've said it before, I'll say it again: you are defined by how you treat your people. Treat them well. That's not a request or suggestion, but an imperative.
071
Ian Campbell @neurovagrant.bsky.social · 02/10/2026
is it friday yet
150
Ian Campbell @neurovagrant.bsky.social · 30/09/2026
OOH OOH OOH OOH Satisfactory just announced its first paid DLC, "Core Values" No date yet, short trailer is up though. Go wishlist. I WANT TO GIVE THEM MY MONEY NAO PLZ.
021
Ian Campbell @neurovagrant.bsky.social · 30/09/2026
Heard a great quote the other day that I think we should amplify: "Windows is the Flock camera of operating systems."
030
Reposted by Ian Campbell
🎃👻BOO👻🎃rritosec @unauthorized.computer · 29/09/2026
This story has the energy of some apocryphal tale from the early aughts but then you see the post dates and realize it's from 2019. And these "design decisions" were likely made only a couple of years prior to the post. Less than a decade removed from load-bearing 500TB Dropbox.
051
Ian Campbell @neurovagrant.bsky.social · 29/09/2026
Had to dig it up for a Signal group so I'll drop it here too. If you haven't read the Reddit thread about the sysadmin who discovered the entire prod system ran out of a 500TB Dropbox that everyone had read/write access to, block off some time in your calendar: www.reddit.com/r/sysadmin/c...
reddit.com
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
4114
Ian Campbell @neurovagrant.bsky.social · 29/09/2026
Thought the MacOS 27 update killed my Macbook air for a minute. Macbook was on the black Apple/progress bar screen and stuck around 80% through the night while updating. Powercycled it this morning and it came up fine on 27. whew.
221
Ian Campbell @neurovagrant.bsky.social · 25/09/2026
So I love the horror genre and resonate with it on a deeply philosophical level, but the new Silent Hill: Townfall game requires you to deal with OT/ICS/SCADA technology and that is simply taking horror too far.
191
Reposted by Ian Campbell
Ian Coldwater 🧊🚫 @lookitup.baby · 24/09/2026
if you quit corporate to become a beekeeper, does that mean you broke out in hives
2265041
Ian Campbell @neurovagrant.bsky.social · 24/09/2026
Hey folks, maybe add 1password-login[.]com to your blocklists immediately. Newly observed about an hour ago. Also check out its nameservers and IP pivot: bitwarden-vault[.]org yesterday, fortivpn[.]download recently, a LOT more badness.
063
Ian Campbell @neurovagrant.bsky.social · 24/09/2026
Humbled to have been presented @domaintools.bsky.social "Bad Actors Badger" Award this evening! Truth is, I am only the last mile, and can't do it w/o everyone in the chain - every bit of dev, every doc, every sale, every customer, we're all badgers. We are the adversaries - let's never let up.
Multicolored glass award in the shape of the DomainTools gear logo reading "Bad Actors Badger Award - Ian Campbell - 2026"
071
Ian Campbell @neurovagrant.bsky.social · 23/09/2026
Has anyone written a "Who's on first?" routine about DNS yet? "What're you looking at?" "A record." "Yes I know it's a record, what is it?" "A record that seems to be a C2 domain." "Okay whatever, now you're just making up things with letters and numbers. Where is this C2 stuff?"
183
Reposted by Ian Campbell
Raphael Satter @raphae.li · 21/09/2026
New: ShinyHunters says it’s fighting with cl0p and the threat researchers that follow these actors are *very* eager to see what’s next. With @ajvicens.bsky.social: www.reuters.com/legal/govern...
reuters.com
Cybercrime feud erupts on dark web as notorious group claims hijack of rival's website
One of the world's best-known cybercrime groups said on Sunday it had hijacked ‌one of its chief rivals' dark web site, bringing what it said was a long-simmering feud out into the open.
1128
Ian Campbell @neurovagrant.bsky.social · 20/09/2026
"Looking at alerts" killed me. Filched from elsewhere.
Elmo-snorting-cocaine meme where the top panel labels elmo as "Cyber security researchers." Healthy fruits on the left are labeled "Patching, MFA, least privilege, looking at alerts." The pile of white powder on the right is labeled "CPUs talking via temperature." In the bottom panel, Elmo is snorting the white powder enthusiastically.
092
Ian Campbell @neurovagrant.bsky.social · 20/09/2026
Eeeeenteresting. www.bellingcat.com/news/2026/09...
bellingcat.com
Christy Kinahan's UAE Residence Visa Cancelled - bellingcat
Irish crime boss Christy Kinahan, who is being pursued by authorities around the world, has had his UAE residence permit cancelled.
021
Ian Campbell @neurovagrant.bsky.social · 18/09/2026
CVS, I think you missed the word "vaccine" unless our relationship has changed in a deeply significant manner...
Text message from CVS pharmacy that begins with "Ian, did you know Hepatitis A is a multi-dose series?"
021
Ian Campbell @neurovagrant.bsky.social · 18/09/2026
Great article on disrupting TeamPCP. Props to Larsen, GTIG, and anyone else involved. www.wired.com/story/an-und...
wired.com
An Undercover Google Analyst Infiltrated a Notorious Supply Chain Hacking Gang
TeamPCP pulled off the worst-ever software supply chain hacking spree and breached thousands of companies. Now Google’s threat intelligence group has revealed it had a mole inside the hackers’ inner c...
020
Ian Campbell @neurovagrant.bsky.social · 14/09/2026
Updated the @ifin@infosec.exchange thread here. Blackfile-suspected list (attached) up to 59. Medium-high confidence. Also attached CSV of 134 domains connected or adjacent to Blackfile/ShinyHunters from Sept 11-14, all worth blocking preemptively. ifin.network/t/blackfile-...
ifin.network
Blackfile & Related emerging domains
Blackfile-suspected list (attached) up to 59. Medium-high confidence. Also attached CSV of 134 domains connected or adjacent to Blackfile/ShinyHunters from Sept 11-14, all worth blocking preemptively...
111
Reposted by Ian Campbell
hakan @hatr.bsky.social · 14/09/2026
After Reuters (@raphae.li and colleagues) reported how a Texas student foiled another attempt of Anthropic-related malware, this marks the second time a volunteer managed to block the operation of a billion-dollar company, doing malicious things without enough oversight
182
Reposted by Ian Campbell
hakan @hatr.bsky.social · 14/09/2026
Some news on "incident 2", the one which had Anthropic "most concerned". Crucially, the malware was stopped within 18 minutes of being uploaded. A trusted security researcher from Austria, working in his spare time, quickly analyzed and then quaranted mlflow-ui www.derstandard.de/story/300000...
derstandard.de
Wie ein Wiener eine KI-Spionagesoftware von Anthropic stoppte
Künstliche Intelligenz lud Schadsoftware auf eine Plattform mit Millionen Nutzern. Ein Cybersicherheitsforscher aus Österreich verhinderte, dass sie sich weiter verbreiten konnte.
12413
Ian Campbell @neurovagrant.bsky.social · 10/09/2026
UK - Anduril - Security Operations Analyst job-boards.greenhouse.io/andurilindus...
job-boards.greenhouse.io
Security Operations Analyst, UK
London, England, United Kingdom
020
Ian Campbell @neurovagrant.bsky.social · 10/09/2026
One of the lessons I have to continue learning and re-learning is to carve out distinct blocks of time to focus on priorities. Task-switching like a mad grasshopper only leads to more jumping around like a mad grasshopper. 30 years of employment in Mad-Grasshopper-as-a-Service is hard to unlearn.
130
Ian Campbell @neurovagrant.bsky.social · 09/09/2026
Imagine getting a C&D from a municipal attorney to stop profiting from AI-generated child sexual abuse material and your strongest argument being jurisdiction of where the CSAM-generators were advertised.
0176
Ian Campbell @neurovagrant.bsky.social · 09/09/2026
irregular reminder: I care much less about your choice to devalue your product with AI slop and much more about how you treat the humans in the loop. If you find yourself at a crossroads about which to value, you have already gone too far, and it is time to find your way back.
020
Ian Campbell @neurovagrant.bsky.social · 09/09/2026
Seeing a few places go loud with Blackfile-related domain lists, most of which are missing multiple entries. Dropped two CSVs over at @ifin-intel.org - 32 domains associated with Blackfile with high confidence, and a larger list of domains observed while hunting. ifin.network/t/blackfile-...
ifin.network
Blackfile & Related emerging domains
Hey folks, Been tracking the Blackfile passkey/mfa campaign for weeks or months now. Saw a recent listing from Unit42 that was missing a few domains I have, and had a few domains I missed. blackfile...
132
Ian Campbell @neurovagrant.bsky.social · 08/09/2026
TIL Hunter Biden is launching a memecoin called "Laptop" themed after his laptop that was seized and then became a focus in the last weeks of the 2020 US presidential race. i hate this timeline.
000
Ian Campbell @neurovagrant.bsky.social · 04/09/2026
me: it's so nice to have today and monday off also me: but think of all the work i could get done if i sign in even earlier than usual today and just push through it like a legend
020
Ian Campbell @neurovagrant.bsky.social · 02/09/2026
today's random find: skybridge[.]click found while mining Engineering alerts for high-volume DNS record domains. RU-hosted DNS-based C2/beacon. OTX pulse connects it to Immortal Stealer. IP pivot to skybridgewithlove[.]space which has a CNAME to i.voiprostov[.]ru mebbe block those.
020
Ian Campbell @neurovagrant.bsky.social · 02/09/2026
Every. Defender. I. Know. (archive link: archive.is/202608311013... ) www.bloomberg.com/news/article...
051
Reposted by Ian Campbell
Dr. Damien P. Williams, dread portent down from a mountain cave @wolven.blacksky.app · 02/09/2026
It's like the words "flash crash" mean nothing to people anymore
0244
Ian Campbell @neurovagrant.bsky.social · 02/09/2026
Conversation on machines doing stock trading this morning reminded me of Knight Capital. Long before ChatGPT, a failed deploy to their high-frequency trading system caused a $400M+ trading loss in 45 minutes. Firm was only worth $300M. Good post on this from 2014: dougseven.com/2014/04/17/k...
dougseven.com
Knightmare: A DevOps Cautionary Tale
In the first 45-minutes the market was open the faulty software deployment sent millions of child orders into the market resulting in 4 million transactions against 154 stocks for more than 397 mil…
0136
Reposted by Ian Campbell
Kym Possible @kympossible.bsky.social · 02/09/2026
TIL @mapquest.com still exists. Are my expectations for the app high? No. But I am petty AF y'all. I can tolerate a whole lot of navigational bullshit to stick it to capitalist shills that won't stand up to narcissistic loser bullies.
121
Ian Campbell @neurovagrant.bsky.social · 01/09/2026
"It's not our fault if you can't keep trade secrets, OpenAI tells Apple" This is an interesting take for a company that wants to be plumbed into every enterprise workflow everywhere. What happens when it's *your* trade secrets? appleinsider.com/articles/26/...
appleinsider.com
031
Ian Campbell @neurovagrant.bsky.social · 01/09/2026
*BLACKFILE CAMPAIGN UPDATE* - Domains seen on the same infrastructure as Blackfile's recent "passkey" extortion campaign point to likely mass-targeting of Mailchimp and Sendgrid users as well, probably for address list exfiltration more than anything. #threatintel #cybersecurity #infosec
discourse.ifin.network
Newly-observed vishing/phishing campaign targeting retail/finance/fintech/more
Domains seen on the same infrastructure as Blackfile’s recent “passkey” extortion campaign point to likely mass-targeting of Mailchimp and Sendgrid users as well, probably for address list exfiltratio...
110
Ian Campbell @neurovagrant.bsky.social · 01/09/2026
Once in a while, Calvin's dad was on point.
Calvin's dad from Calvin and Hobbes saying in an educational tone, "You see, Calvin, most locks are more suggestions than anything else. It's consent that keeps them operational."
110
Ian Campbell @neurovagrant.bsky.social · 31/08/2026
In other news, it has been zero (0) days since I burned my mouth on home-cooked pizza due to not letting it cool before trying to eat it.
020
Ian Campbell @neurovagrant.bsky.social · 31/08/2026
I feel like being enough of an ass that *Kalshi* wants nothing to do with you should cause even more soul-searching than a prison term. www.nytimes.com/2026/08/31/b...
nytimes.com
Kalshi Permanently Bars George Santos From the Platform (Gift Article)
The prediction market said it had barred George Santos, the former congressman from New York, and fined him $71,356 over evidence he engaged in insider trading.
000
Ian Campbell @neurovagrant.bsky.social · 30/08/2026
the rm -rf's will continue until morale improves
Tweet from SebastienGilmt from Aug 26 2026:

Bad news: Fable nuked my entire dev machine

Claude decided to test a sandbox it was building by running `rm -rf` on my home directory

The sandbox didn't work.
It's all gone

with an image of terminal output explaining the disastrous mistake.
03910
Ian Campbell @neurovagrant.bsky.social · 28/08/2026
Okay, so we can hopefully say this is the most disturbing meme of the year. Because anything that eclipses this enters into "existential cognitohazard" territory.
020
Ian Campbell @neurovagrant.bsky.social · 28/08/2026
This was fascinating research to watch develop - the original reporting centered around "school for hackers" but the leak showed a hell of a lot more. Also...if this had been the curriculum, maybe I would have gone to college for more than a semester...
020
Ian Campbell @neurovagrant.bsky.social · 27/08/2026
tryin' to decide on my next CFP. got a couple of ideas, but also curious. what would YOU want to hear me talk about at an infosec conference?
120
Ian Campbell @neurovagrant.bsky.social · 27/08/2026
the thing about lots of fucking around is that you invite lots of attention to help you find out.
020
Ian Campbell @neurovagrant.bsky.social · 27/08/2026
HIS BUSINESS WAS NAMED OPSEC EXPRESS. i love it.
110
Ian Campbell @neurovagrant.bsky.social · 26/08/2026
Dolly would have been so good in Clue.
050
Ian Campbell @neurovagrant.bsky.social · 26/08/2026
i expect everyone else arrived here before me but i was today years old when I realized: the reverse of DEF CON is NOC FED.
040
Ian Campbell @neurovagrant.bsky.social · 26/08/2026
I gotta say, Dolly Parton's passing, given that her main cause was getting kids to read, casts Amazon's destruction-at-scale of books for AI training data in an even starker light.
000
Ian Campbell @neurovagrant.bsky.social · 26/08/2026
amazing. plus i gotta respect an excellent in-the-wild use of the word "gank" - it really is the ideal context here.
000