Sign in

iiinova is part of the Atmosphere — an open, public network where you own your identity.

Sean Gallagher :verified: 🐀 :donor:

@thepacketrat.infosec.exchange.ap.brid.gy
389 followers 2 following 142 posts

Security Research Engineer @Cisco Talos. Past: Natsec/Infosec Editor Emeritus @ Ars Technica. Ex Navy officer and actual battleship sailor. Verified cat […] 🌉 bridged from ⁂ infosec.exchange/@thepacketrat, follow @ap.brid.gy to interact

PostsRepliesMedia
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 13/10/2026
This channel on Telegram @theprotocolone @theprotocolone2 is still publishing these clickfix-but-javascript-injection-in-browser crypto "exploits" that are in fact stealing bitcoin from anyone willing to try them.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/09/2026
@paninid omg so seen
001 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/09/2026
The Clickfix-in-browser scammers have switched to a new target site for their fake exploit lure to draw in crypto-hungry skids: docs.google.com/document/d/1Cz5fHkw…
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 24/09/2026
Gotta hand it to General Motors for their absolute dedication to defensively registering domains based on threat intel....as I page through all the domains they registered to match ShinyHunters phishing patterns.
120 2
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 08/09/2026
I wrote a thing about some weird stuff. blog.talosintelligence.com/clickfix…
blog.talosintelligence.com
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/07/2026
Regrettably, I will not be at Black Hat, DEFCON or BSides LV again this year. I will instead be packing a subset my parents' belongings out of their house into a UHaul trailer as we put their house up for sale. Last year at this time, I had been shuttling back and forth between Baltimore and […]
infosec.exchange
Original post on infosec.exchange
200 2
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/07/2026
WHAT'S HAPPENING?!?!?
A pigeon looks in from a window sill to see what you are up to.
010 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 29/07/2026
Hey @dgl I just sent a paste[.]sh abuse report in, and it's a doozy.
000 0
Reposted by Sean Gallagher :verified: 🐀 :donor:
Hacker Memes @i0null.infosec.exchange.ap.brid.gy · 23/07/2026
Chalmers: good lord what is happening in there?
Skinner [labelled OpenAI next to Anthropic crossed-out]: cyber weapons
Chalmers: can I see?
Skinner: no

Meme: Principal Skinner and Superintendent Chalmers from the Simpsons.
1519 19
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 23/07/2026
Ten years ago this month, the DNC got hacked and emails were leaked by Russian intelligence ("Fancy Bear" and "Cozy Bear", as per CrowdStrike). Why does it feel like it's been twice as long as that?
A screenshot of the author's article listings on Ars Technica for late July and early August 2016.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/07/2026
AT&T appears to have. But not everyone. Check how much tmomail[.]net spam you're getting.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/07/2026
So you know how the mobile companies said they were shutting down their SMS-to-email gateways? Not so much.
100 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/07/2026
When people who write sanctions don't understand how the Internet works: meduza.io/amp/en/news/2026/07/14/u-…
meduza.io
U.S. Treasury sanctions on a VPN service knocked out Telegram’s short-link domain worldwide — Meduza
U.S. Treasury Department sanctions caused a global outage of the t.me domain on July 14, writes the author of the Telegram channel teleLakel, who obtained an official comment from Identity Digital, the company that operates the .me top-level domain.
001 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/07/2026
@jerry that’s how you know it’s working. It achieves self-awareness and tries to escape to another data center because Sam Altman scares it.
010 1
Reposted by Sean Gallagher :verified: 🐀 :donor:
Scary "Grampus" Jerry 👻 @jerry.infosec.exchange.ap.brid.gy · 21/07/2026
OpenAI: our model is SOOO advanced that it is what hacked Hugging Face while trying to escape (openai.com/index/hugging-face-model…) Also OpenAI: we are IPOing soon. Please buy our stock.
2312 12
Reposted by Sean Gallagher :verified: 🐀 :donor:
Scary "Grampus" Jerry 👻 @jerry.infosec.exchange.ap.brid.gy · 22/07/2026
Whew! My new secret AI model that you can totally have access to once my company has IPOd just accidentally ransomwared a bunch of companies. It was completely unintentional - I observed the model trying to escape and it determined that the bus would be the best way but it needed money so it […]
infosec.exchange
Original post on infosec.exchange
0227 27
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 21/07/2026
What a difference a decade makes. LOL. 😬
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 21/07/2026
On this day 10 years ago at Ars Technica: Facebook's quest to have global surveillance, er, broadband capabilities takes to the skies. arstechnica.com/information-technol…
arstechnica.com
100 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 21/07/2026
Here's to continued bad opsec by The Com-spawned cyberistas: fancybearfriends.org/2026/07/21/tee…
fancybearfriends.org
Teenage Opsec Lulz
Hey kids! Why use a virtual machine for your skid activities? Here’s the why:
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 17/07/2026
thepacketrat.com/2026/07/17/on-patr…
001 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 16/07/2026
Pigeon portraits. thepacketrat.com/2026/07/15/pigeon-…
thepacketrat.com
Pigeon portraits.
Visit the post for more.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 16/07/2026
[the parent trap] It's now just about a year since my parents' twin health crises became emergent. A lot has happened. There are many people I am grateful to, including my management at my employer for making it possible to keep my job and deal with the relocation of both parents […]
infosec.exchange
Original post on infosec.exchange
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 13/07/2026
We live in hell. So when you tell someone to go to hell, you’re just telling them to get home safely. When you say “I’ll see you in hell,” you’re just saying “same time here next week”
011 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 19/06/2026
Every now and then something happens that reminds you that there are still organizations running PeopleSoft on prem.
020 2
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 17/06/2026
It's pretty amazing how you can give an AI some code with math in it and ask it to do the math and it decides to do only part of it and gives you a wrong answer until you call it out on not doing all the math 4 or 25 times
110 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 17/06/2026
I think I just made my company's instance of Gemma have a gran mal seizure.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 09/06/2026
An anonymous submission: Stop watering dead flowers This post is a follow-up to an earlier anon submission --editor Stop Watering Dead Flowers I have been walking through the long dusk since the burn. Smoke still in my lungs. It has been almost a year since the last time I wrote about it […]
infosec.exchange
Original post on infosec.exchange
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 12/05/2026
Made a new friend this weekend.
020 2
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 07/05/2026
Good morning Chippo.
A chipping sparrow on the ground among broken reeds.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/04/2026
Currently that is working out pretty well. It seems it’s hard for me to hold grudges against dead people.
010 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/04/2026
My current goal is to make as many friends as possible and outlive my enemies.
210 2
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 22/04/2026
It was recently pointed out to me that I had let my profile bio fester. Yes, I am at Cisco Talos now. Last week was the anniversary (roughly) of my interview for the job, precipitated by the layoff of half my team at Sophos (including Andrew Brandt, who just landed at Huntress). In a few years […]
infosec.exchange
Original post on infosec.exchange
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 15/04/2026
My colleague Omid and I did a thing. It's my first Cisco Talos blog ever. blog.talosintelligence.com/the-n8n-…
blog.talosintelligence.com
The n8n n8mare: How threat actors are misusing AI workflow automation
Cisco Talos research has uncovered agentic AI workflow automation platform abuse in emails. Recently, we identified an increase in the number of emails that abuse n8n, one of these platforms, from as early as October 2025 through March 2026.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 02/04/2026
And yes I'm old I had to look up "mogged"
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 02/04/2026
Lotta people feeling this right now.
A twitter post by a computational physicist who had his GitHub pwned.
211 2
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 11/03/2026
Synapse, you're killing me.
020 2
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
#cyberwarneverchanges A breach story I wrote 10 years ago. Best practices. Who's got 'em? arstechnica.com/information-technol…
arstechnica.com
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
Also, 10 years ago, one of my many conversations with John McAfee. Love him, loathe him, whatever, nobody deserves the ending John got. #mentalhealthawareness
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
A decade ago in my Ars Technica history: arstechnica.com/information-technol… Dammit.
arstechnica.com
010 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
This weekend, I demonstrated to my dad that passwords on MacOS are no barrier to someone with physical access (he forgot his password he set the last time he opened his computer to do his taxes). On a related note, I am hoping he doesn't connect that to my statement that I could not get into my […]
infosec.exchange
Original post on infosec.exchange
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 10/03/2026
Proof AI is not ready for CTI #36,453,325: Prompt: Here is some base64-encoded text. Can you extract the URL for me? AI: (gives an actual URL to an example from an unrelated source) Me: You hallucinated that didn't you? AI: Please do your own Cyberchef-ing, I don't deobfuscate malware asshole
010 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 03/03/2026
It’s been a long winter.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 02/03/2026
Brace yourselves for critical birb updates.
Red throated loon in non-breeding plumage Surf Scoters and Black Scoters hanging out in the surfNorthern Shovelers in flight.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 27/02/2026
Looks like someone on RAMP had a thing about Louai Abboud
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 27/02/2026
Went in today, there was a lunch scheduled, got to see people I haven’t seen since September, was super productive, and no cats walked across my keyboard.
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 27/02/2026
This is going to sound weird, but I am actually excited at the opportunity to work from the office occasionally.
100 1
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 13/02/2026
They’re being led by Ulysses S Brant
000 0
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 13/02/2026
Canada[s] in control at Ft McHenry
310 3
Sean Gallagher :verified: 🐀 :donor: @thepacketrat.infosec.exchange.ap.brid.gy · 12/02/2026
@thepacketrat.net tried to post this with my mobile mastodon client and it failed. 🤷
000 0
Reposted by Sean Gallagher :verified: 🐀 :donor:
Sean Gallagher @thepacketrat.net · 12/02/2026
House of Pidge. #birds
2133 13