Sign in

Sean Gallagher :verified: 🐀 :donor:

@thepacketrat.infosec.exchange.ap.brid.gy
389 followers 2 following 142 posts

Security Research Engineer @Cisco Talos. Past: Natsec/Infosec Editor Emeritus @ Ars Technica. Ex Navy officer and actual battleship sailor. Verified cat […] 🌉 bridged from ⁂ infosec.exchange/@thepacketrat, follow @ap.brid.gy to interact

PostsRepliesMedia
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 13/10/2026
This channel on Telegram @theprotocolone @theprotocolone2 is still publishing these clickfix-but-javascript-injection-in-browser crypto "exploits" that are in fact stealing bitcoin from anyone willing to try them.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/09/2026
The Clickfix-in-browser scammers have switched to a new target site for their fake exploit lure to draw in crypto-hungry skids: docs.google.com/document/d/1Cz5fHkw…
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 24/09/2026
Gotta hand it to General Motors for their absolute dedication to defensively registering domains based on threat intel....as I page through all the domains they registered to match ShinyHunters phishing patterns.
120
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 08/09/2026
I wrote a thing about some weird stuff. blog.talosintelligence.com/clickfix…
blog.talosintelligence.com
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/07/2026
Regrettably, I will not be at Black Hat, DEFCON or BSides LV again this year. I will instead be packing a subset my parents' belongings out of their house into a UHaul trailer as we put their house up for sale. Last year at this time, I had been shuttling back and forth between Baltimore and […]
infosec.exchange
Original post on infosec.exchange
200
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/07/2026
WHAT'S HAPPENING?!?!?
A pigeon looks in from a window sill to see what you are up to.
010
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/07/2026
Hey @dgl I just sent a paste[.]sh abuse report in, and it's a doozy.
000
Reposted by Sean Gallagher :verified: 🐀 :donor:
Hacker Memes @i0null.infosec.exchange.ap.brid.gy · 23/07/2026
Chalmers: good lord what is happening in there?
Skinner [labelled OpenAI next to Anthropic crossed-out]: cyber weapons
Chalmers: can I see?
Skinner: no

Meme: Principal Skinner and Superintendent Chalmers from the Simpsons.
1519
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 23/07/2026
Ten years ago this month, the DNC got hacked and emails were leaked by Russian intelligence ("Fancy Bear" and "Cozy Bear", as per CrowdStrike). Why does it feel like it's been twice as long as that?
A screenshot of the author's article listings on Ars Technica for late July and early August 2016.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/07/2026
So you know how the mobile companies said they were shutting down their SMS-to-email gateways? Not so much.
100
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/07/2026
When people who write sanctions don't understand how the Internet works: meduza.io/amp/en/news/2026/07/14/u-…
meduza.io
U.S. Treasury sanctions on a VPN service knocked out Telegram’s short-link domain worldwide — Meduza
U.S. Treasury Department sanctions caused a global outage of the t.me domain on July 14, writes the author of the Telegram channel teleLakel, who obtained an official comment from Identity Digital, the company that operates the .me top-level domain.
001
Reposted by Sean Gallagher :verified: 🐀 :donor:
Scary "Grampus" Jerry 👻 @jerry.infosec.exchange.ap.brid.gy · 21/07/2026
OpenAI: our model is SOOO advanced that it is what hacked Hugging Face while trying to escape (openai.com/index/hugging-face-model…) Also OpenAI: we are IPOing soon. Please buy our stock.
2312
Reposted by Sean Gallagher :verified: 🐀 :donor:
Scary "Grampus" Jerry 👻 @jerry.infosec.exchange.ap.brid.gy · 22/07/2026
Whew! My new secret AI model that you can totally have access to once my company has IPOd just accidentally ransomwared a bunch of companies. It was completely unintentional - I observed the model trying to escape and it determined that the bus would be the best way but it needed money so it […]
infosec.exchange
Original post on infosec.exchange
0227
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 21/07/2026
On this day 10 years ago at Ars Technica: Facebook's quest to have global surveillance, er, broadband capabilities takes to the skies. arstechnica.com/information-technol…
arstechnica.com
100
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 21/07/2026
Here's to continued bad opsec by The Com-spawned cyberistas: fancybearfriends.org/2026/07/21/tee…
fancybearfriends.org
Teenage Opsec Lulz
Hey kids! Why use a virtual machine for your skid activities? Here’s the why:
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 17/07/2026
thepacketrat.com/2026/07/17/on-patr…
001
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 16/07/2026
Pigeon portraits. thepacketrat.com/2026/07/15/pigeon-…
thepacketrat.com
Pigeon portraits.
Visit the post for more.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 16/07/2026
[the parent trap] It's now just about a year since my parents' twin health crises became emergent. A lot has happened. There are many people I am grateful to, including my management at my employer for making it possible to keep my job and deal with the relocation of both parents […]
infosec.exchange
Original post on infosec.exchange
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 13/07/2026
We live in hell. So when you tell someone to go to hell, you’re just telling them to get home safely. When you say “I’ll see you in hell,” you’re just saying “same time here next week”
011
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 19/06/2026
Every now and then something happens that reminds you that there are still organizations running PeopleSoft on prem.
020
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 17/06/2026
It's pretty amazing how you can give an AI some code with math in it and ask it to do the math and it decides to do only part of it and gives you a wrong answer until you call it out on not doing all the math 4 or 25 times
110
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 17/06/2026
I think I just made my company's instance of Gemma have a gran mal seizure.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 09/06/2026
An anonymous submission: Stop watering dead flowers This post is a follow-up to an earlier anon submission --editor Stop Watering Dead Flowers I have been walking through the long dusk since the burn. Smoke still in my lungs. It has been almost a year since the last time I wrote about it […]
infosec.exchange
Original post on infosec.exchange
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 12/05/2026
Made a new friend this weekend.
020
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 07/05/2026
Good morning Chippo.
A chipping sparrow on the ground among broken reeds.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/04/2026
My current goal is to make as many friends as possible and outlive my enemies.
210
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/04/2026
It was recently pointed out to me that I had let my profile bio fester. Yes, I am at Cisco Talos now. Last week was the anniversary (roughly) of my interview for the job, precipitated by the layoff of half my team at Sophos (including Andrew Brandt, who just landed at Huntress). In a few years […]
infosec.exchange
Original post on infosec.exchange
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 15/04/2026
My colleague Omid and I did a thing. It's my first Cisco Talos blog ever. blog.talosintelligence.com/the-n8n-…
blog.talosintelligence.com
The n8n n8mare: How threat actors are misusing AI workflow automation
Cisco Talos research has uncovered agentic AI workflow automation platform abuse in emails. Recently, we identified an increase in the number of emails that abuse n8n, one of these platforms, from as early as October 2025 through March 2026.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 02/04/2026
Lotta people feeling this right now.
A twitter post by a computational physicist who had his GitHub pwned.
211
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 11/03/2026
Synapse, you're killing me.
020
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
#cyberwarneverchanges A breach story I wrote 10 years ago. Best practices. Who's got 'em? arstechnica.com/information-technol…
arstechnica.com
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
Also, 10 years ago, one of my many conversations with John McAfee. Love him, loathe him, whatever, nobody deserves the ending John got. #mentalhealthawareness
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
A decade ago in my Ars Technica history: arstechnica.com/information-technol… Dammit.
arstechnica.com
010
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
This weekend, I demonstrated to my dad that passwords on MacOS are no barrier to someone with physical access (he forgot his password he set the last time he opened his computer to do his taxes). On a related note, I am hoping he doesn't connect that to my statement that I could not get into my […]
infosec.exchange
Original post on infosec.exchange
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
Proof AI is not ready for CTI #36,453,325: Prompt: Here is some base64-encoded text. Can you extract the URL for me? AI: (gives an actual URL to an example from an unrelated source) Me: You hallucinated that didn't you? AI: Please do your own Cyberchef-ing, I don't deobfuscate malware asshole
010
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 03/03/2026
It’s been a long winter.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 02/03/2026
Brace yourselves for critical birb updates.
Red throated loon in non-breeding plumage Surf Scoters and Black Scoters hanging out in the surfNorthern Shovelers in flight.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 27/02/2026
Looks like someone on RAMP had a thing about Louai Abboud
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 27/02/2026
This is going to sound weird, but I am actually excited at the opportunity to work from the office occasionally.
100
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 13/02/2026
Canada[s] in control at Ft McHenry
310
Reposted by Sean Gallagher :verified: 🐀 :donor:
Sean Gallagher @thepacketrat.net · 12/02/2026
House of Pidge. #birds
2133
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/02/2026
Apple iOS facial recognition fails when you have a tissue stuffed up your nose to stop a nose bleed.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/02/2026
The lunch crowd at my place is a little more polite these days
010
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/02/2026
Murderkeet
A photo of a Red-Shouldered Hawk, his/her head turned to viewer's right.
000
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/02/2026
When the phishing adversary uses a free platform to create a phishing page but forgets all the flare (and monetization) the platform provider injects... And people still give their credentials.
A screenshot of an Outlook phishing site with a "made with Softr" graphic and an advertisement popping up at the bottom for some game.
321
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/02/2026
Hey, everyone! Sorry for the extended period of silence. A lot of stuff has been going down irt dealing with aging and ailing parents, and since the start of the new year I have been focusing on getting back to work. The infosec and bird-related content feed is now ready to resume.
A downy woodpecker looks a little overwhelmed but is hanging in there.
020
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 13/12/2025
My pottery efforts have taken a strange turn.
030
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 07/12/2025
Hey all. I have been quiet on this channel for a minute , because, well, things. My parents both have had health crises in the last six months and in October I relocated them to Baltimore for surgery and memory care, respectively. My dad’s now a below-knee amputee and a few weeks away from […]
infosec.exchange
Original post on infosec.exchange
100
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 02/10/2025
The complexities of caring for a parent you don’t like. I just spent five days on a rescue mission. Immediately after returning home from a business trip, my wife and I loaded up and drove to distant upstate NY to retrieve my parents to bring them back with us for medical reasons. The primary […]
infosec.exchange
Original post on infosec.exchange
220
Reposted by Sean Gallagher :verified: 🐀 :donor:
Sean Gallagher @thepacketrat.net · 28/07/2025
I have been trying to get a document signed with my dad’s lawyer for nearly six months. First draft: my first name was misspelled. Second draft: my last name was misspelled. Third draft: reviewed whole doc, my first name was misspelled and my address was in the wrong state. 🫠🤦🏻‍♂️🤦🤦‍♀️🙈
3121