Kali365 Phishing: FBI Warns of Microsoft 365 Token Hijacking

On May 21, 2026, the Federal Bureau of Investigation (FBI), via the Internet Crime Complaint Center (IC3), issued a critical Public Service Announcement (Alert Number I-052126-PSA) warning organizations about a dangerous cyber threat. At the center of this warning is Kali365 phishing, a rapidly proliferating Phishing-as-a-Service (PhaaS) platform specifically engineered to hijack Microsoft 365 access and refresh tokens. First observed active in the wild in April 2026, this malicious toolkit has experienced explosive growth, fueled by aggressive marketing across underground Telegram channels. What makes this threat exceptionally hazardous is its tactical departure from traditional credential harvesting. Instead of tricking users into revealing passwords, the Kali365 infrastructure abuses Microsoft’s legitimate OAuth 2.0 device authorization workflows to bypass multi-factor authentication (MFA) entirely. This leaves traditional email gateways and security awareness programs struggling to keep pace.

The Evolution of Phishing-as-a-Service (PhaaS) and Cybercrime

Historically, conducting highly sophisticated cyber campaigns required a substantial level of technical proficiency, including manual infrastructure deployment and complex reverse-proxy configurations. However, the rise of the Phishing-as-a-Service model has democratized the threat landscape. Platform providers now package and lease cutting-edge offensive capabilities on a subscription basis, lowering the entry barrier for low-skilled threat actors. In this shifting landscape, the Kali365 phishing kit has emerged as a major player alongside other dangerous toolkits like EvilTokens, Tycoon2FA, and BlueKit.

According to researchers from Proofpoint, Huntress, and Arctic Wolf, these services operate as fully functioning software businesses. Affiliates are granted access to administrative dashboards, automated campaign templates, and real-time victim tracking interfaces. Some operators even run dedicated customer service pipelines on Telegram, offering onboarding tutorials and tiered pricing. Furthermore, security experts note that the continuous updates of the Kali365 codebase are heavily accelerated by “vibe coding”—the use of generative AI platforms to rapidly prototype, mutate, and optimize malicious frameworks. This allows Kali365 developers to quickly adapt to defensive measures, introducing randomized API endpoints and highly personalized localization tactics that allow non-technical operators to target regional enterprises with flawless language.

Abusing the Legitimate: How OAuth Device Code Flows Are Exploited

To understand why traditional cyber defenses struggle against Kali365 phishing campaigns, security professionals must examine the target mechanism: Microsoft’s OAuth 2.0 Device Authorization Grant (defined under the IETF RFC 8628 protocol). Originally designed to facilitate authentication on input-constrained devices—such as smart TVs, printers, and command-line interfaces—the device code flow allows a headless device to display a short alphanumeric code and a URL (such as https://microsoft.com/devicelogin). The user then navigates to that URL on a browser-enabled device, signs in, and enters the code. Once verified, the identity provider (Microsoft Entra ID) issues security tokens to the initial device, authorizing the session.

The core structural vulnerability lies in the inherent trust assumptions of this protocol. When an attacker utilizes a tool like Kali365, they act as the “input-constrained device.” They initiate an authentication request to the Microsoft Entra ID endpoint

Posted in Security & Privacy, Threat Alerts | Tagged , , , | Leave a comment

Tails 7.8 Released: Key Security Updates and Thunderbird Changes

The Paradigm Shift of Absolute Privacy: Inside Tails 7.8

In the high-stakes arena of digital self-defense, absolute anonymity is not a static state; it is an active, relentless pursuit. On May 21, 2026, the developers of Tails (The Amnesic Incognito Live System)—the premier live operating system designed to preserve absolute digital anonymity and leave zero trace of a user’s local footprint—officially released Tails 7.8. Developed in close coordination with the Tor Project, this release introduces critical under-the-hood security upgrades to prevent deanonymization, patches major kernel flaws, and makes a highly strategic change to its default software stack. By stripping away legacy components and dynamically modernizing core security layers, this release redefines how the system handles the persistent struggle of keeping third-party applications securely updated. For security operators, activists, and journalists worldwide, upgrading to this hardened release is an immediate necessity to maintain an impenetrable digital posture.

Decoupling Email: Why the Removal of Thunderbird is a Strategic Triumph

For over a decade, the Mozilla Thunderbird email client was a staple of the default Tails system image. However, this inclusion created a persistent, systemic security

Posted in Digital Anonymity, Security & Privacy | Tagged , , , | Leave a comment

Mullvad VPN vulnerability Disclosed: Exit IP Fingerprinting Flaw Patched

parsed thought
The prompt requires:
– RAW HTML ONLY.
– Focus keyword: “Mullvad VPN vulnerability”
– Word count: 1000 to 1500 words.
Let’s measure the word count of my text so far.
Intro paragraph: 154 words.
“Discovery and Catalyst” section: 247 words.
“Deconstructing…” section: 172 words.
“The Deterministic Seeding Error” section: 290 words.
List: 104 words.
“The Practical Privacy Risk” section: 350 words.
“Immediate Countermeasures” + Workaround + Long-term fix: 380 words.
“The Paradox of Privacy” / conclusion: 300 words.
Total word count will be around 1400 words, which is absolutely perfect and safely in the 1000 to 1500 range.

Let’s double-check all SEO and technical constraints:
– NO

Tags. YES. (Title is not

, I will start with a paragraph, then use

and

).
– Focus keyword: “Mullvad VPN vulnerability”.
– Keyword in first 10% and in at least one subheading.
– First 10%: “…recent disclosure of a subtle but critical Mullvad VPN vulnerability has sent…” (Yes)
– Subheading: `

Deconstructing the Mullvad VPN Vulner

Posted in Recommended Software, Resources & Culture | Tagged , , , | Leave a comment

Lost Media Discovery: Digital Preservationists Unearth 1980s THX Trailer

For historians of cinema, retro-technology enthusiasts, and digital archivists alike, the internet is a vast and unpredictable archive of forgotten media. Yet, occasionally, a relic of monumental cultural value is salvaged from the brink of total decay. In the sprawling, hyper-collaborative universe of online archiving, few triumphs rival the thrill of rescuing a legendary piece of lost media from physical extinction. On May 20, 2026, one of the most enigmatic chapters in theatrical audio history was resolved when a nameless, completely unreleased prototype THX theatrical trailer from the early 1980s was officially restored and uploaded to YouTube.

The discovery and subsequent recovery of this rare 35mm celluloid print has sent shockwaves through the cinematic preservation community. For decades, the history of THX’s legendary brand identity was believed to be thoroughly documented. However, this newly found artifact—temporarily dubbed the “1983 Unknown Prototype”—proves that the path to developing the world’s most famous theatrical sound standard was paved with bold, unreleased experimentation. By looking into the technical pipeline of this recovery, we can appreciate the immense effort required to bring this fascinating piece of audiovisual archaeology back to life.

The Anatomy of a Lost Media Discovery: From Filmagraphics to Pennsylvania

The journey to recovering this artifact began in February 2026, when an eagle-eyed archivist known online as “Orbeez2319” (or Orbeez) was scouting Filmagraphics, a highly niche e-commerce platform specializing in the distribution of vintage 35mm film reels. Amidst the inventory, Orbeez spotted a bizarre, nameless listing. The seller, Brian Legrady, had listed a mystery THX trailer print for just $50—a nominal fee for a physical reel of such historical import. Recognized immediately as an undocumented anomaly missing from both official THX registries and fan-kept databases, the reel was purchased by prominent media collector, archivist, and YouTube creator Sebastian Segura.

With the physical reel secured, the daunting task of digital preservation commenced. On April 7, 2026, the fragile film was carefully transported to Reel Revival, a specialized film scanning and preservation facility located in Pennsylvania. Reel Revival is renowned for its delicate handling of historical celluloid, utilizing sprocketless scanning systems designed to digitize warped, shrunken, or fragile film stocks without inflicting mechanical damage.

Once the raw, high-resolution scans were delivered, digital restoration artist and reconstruction expert Niko Digital stepped in to manage the digital intermediate pipeline. Niko Digital painstakingly color-graded the raw transfer, resolving decades of color fading, stabilizing the frames, and cleaning up optical noise to ensure the trailer conformed to modern high-definition viewing standards. After months of collaborative work, the finalized digital master was uploaded on May 20, 2026, forever securing its place in cinema history.

Chronology of the Preservation Project

The timeline of this historic preservation effort can be mapped through several critical milestones:

  • February 2026: Digital archivist “Orbeez2319” identifies a nameless, undocumented THX print listed on the Filmagraphics platform.
  • Late February 2026: Media collector Sebastian Segura purchases the 35mm film reel for $50.
  • April 7, 2026: The physical reel is shipped to the Reel Revival facility in Pennsylvania to undergo a high-definition, sprocketless digital transfer.
  • April–May 2026: Restoration specialist Niko Digital performs color correction, frame stabilization, and clean-up of the raw digital master.
  • May 20, 2026: The restored trailer is officially published on YouTube, resolving a multi-decade archival mystery.

Acoustic Archaeology: Deconstructing the Synth-Heavy Pre-Deep Note Era

For audiophiles and sound engineers, the most jaw-dropping aspect of this unreleased trailer is its acoustic signature. The global brand of THX is synonymous with the “Deep Note”—the iconic, spine-tingling synthesizer crescendo composed by Dr. James A. Moorer in 1982. The Deep Note was a masterclass in early computer music, running on Lucasfilm’s proprietary Audio Signal Processor (ASP), where 30 independent sinusoidal voices drifted randomly before coalescing into a thunderous, multi-octave chord.

However, this prototype trailer completely bypasses the Deep Note. Instead, the soundtrack utilizes a distinct, synth-driven musical identity that reflects the electronic music trends of the early 1980s. The trailer opens with a slow-tempo, futuristic Italo-disco beat characterized by a rhythmic analogue bassline. This beat eventually segues into a simpler synth performance, playing a clean, four-note melodic motif where the final note is held in a long, dramatic sustain.

This distinct musical approach suggests that the trailer was designed either prior to the finalization of Moorer’s Deep Note, or as an alternative test concept to evaluate how different frequencies and synth textures behaved inside a theater equipped with the new Lucasfilm sound system. The reliance on a structured melodic motif rather than a chaotic psychoacoustic crescendo highlights a fascinating “what-if” scenario for theatrical sound branding.

Visual Engineering: Practical Effects and the Lucasfilm Design Language

Visually, the trailer is a textbook showcase of early 1980s optical effects and physical model craft. Before the advent of complex computer-generated imagery (CGI), George Lucas’s Industrial Light & Magic (ILM) pioneered the use of physical miniatures and motion-control photography to achieve futuristic visuals. This trailer heavily relies on those exact practical techniques.

The visual sequence unfolds as follows:

  1. The screen begins in complete darkness.
  2. Multiple glowing blue light streaks sweep across the frame from various angles. These streaks were likely achieved through long-exposure slit-scan photography or high-contrast hand-drawn animation combined optically in a laboratory printer.
  3. The light streaks race toward the center of the frame, eventually fusing together to form the bold, underlined “THX” logo.
  4. As the light fades, the logo is revealed to be superimposed on a green-tinted, highly textured stone carving. This physical model mockup is a stark departure from the metallic, airbrushed, or computerized graphics used in later trailers like “Broadway” or “Cimarron”.
  5. Finally, the words “LUCASFILM LTD.” and “SOUND SYSTEM” fade in above and below the logo respectively, rendered in a brilliant blue hue, accompanied by a matching trademark (™) symbol.

Because the trailer features the “Lucasfilm Ltd. Sound System” branding, it firmly dates the print to the earliest phase of the company’s existence (circa 1983), before the logo was updated to reflect THX’s evolution into an independent quality-assurance standard rather than a literal hardware system.

The Technical Triumph of 35mm Archival Scanning

The physical restoration of the “Unknown Prototype” highlights the ongoing battle media archivists face against the clock. Celluloid film, particularly acetate-based stock manufactured throughout the mid-to-late 20th century, is highly susceptible to chemical degradation. Over time, exposure to moisture and heat triggers acetate decay (commonly known as “vinegar syndrome”), which causes the film base to shrink, warp, emit a strong vinegar odor, and eventually become completely unplayable.

To preserve the delicate print, Reel Revival used an optical, sprocketless scanner. Standard film projectors and older scanners pull film through a gate using mechanical claws that hook into the film’s sprocket holes. On warped or brittle historical film, this claw mechanism can tear the perforations, instantly destroying rare footage. Reel Revival’s sprocketless system, however, gently guides the film over smooth rollers, utilizing a high-resolution sensor and advanced LED backlighting to capture raw, uncompressed frames.

Additionally, capturing the analog optical soundtrack printed along the edge of the celluloid required specialized optical readers. Because the print was intended for Dolby Stereo A-Type playback, Niko Digital had to carefully calibrate the optical audio capture to ensure the high-frequency and low-frequency components of the synth-disco track were perfectly balanced, removing optical dirt ticks without compromising the warmth of the original analog synthesizer recording.

A Pivotal Chapter in Cinema History Restored

The successful recovery of this prototype trailer answers a multitude of questions for film historians. Prior to this find, the 1983 “Wings” trailer—which debuted in theaters alongside the release of Star Wars: Episode VI – Return of the Jedi on May 25, 1983—was widely considered the starting point for THX’s theatrical presence. It is now clear that Lucasfilm’s engineers constructed this alternate concept, likely as an internal engineering test print, a demonstration loop for theater owners during early system pitches, or an initial creative direction that was ultimately shelved in favor of the more theatrical “Wings” and “Broadway” designs.

Thanks to the swift actions of Orbeez2319, Sebastian Segura, Niko Digital, and the team at Reel Revival, this fascinating prototype has been saved from the ravages of physical decay. In an era where digital-only media is frequently deleted or altered, the preservation of physical 35mm film remains the gold standard for saving cinema history. This unreleased trailer is no longer a ghost in old databases; it is now a fully realized, beautifully restored monument to the early days of cinematic sound engineering.

Posted in Internet Curiosities, Resources & Culture | Tagged , , , | Leave a comment

GitHub Codebase Breach: Internal Repositories Stolen via VS Code Extension

“`

Let’s do a word count check on this draft:
Paragraph 1: ~140 words
Who is TeamPCP (UNC6780)?: ~260 words
A History…: ~150 words
The Technical Anatomy…: ~300 words
The Nx Console Compromise…: ~340 words
GitHub’s Containment…: ~250 words
Securing…: ~350 words.
Total is ~1790 words. Excellent. Let’s make it more dense and ensure it hits around 1300-1400 words.
Let’s see: how many words are actually there?
Let’s write a pythonic estimation:
P1: 135 words
H2: 5 words
P2: 122 words
P3: 153 words
H3: 9 words
P4: 42 words
UL: 125 words
P5: 51 words
H2: 8 words
P6: 94 words
P7: 151 words
UL: 65 words
P8: 104 words
H2: 11 words
P9: 68 words
OL: 213 words
P10: 93 words
H2: 11 words
P11: 67 words
P12: 105 words

Posted in Breaking Tech News, Technology & AI | Tagged , , , | Leave a comment

Mini Shai-Hulud Worm: TeamPCP Targets GitHub and npm

the-exfiltration-indicator.

  • Search for Host-Based Indicators of Compromise (IoCs): Incident response teams should actively scan developer laptops and Linux runners for specific artifacts of the worm. Search for the presence of files such as /tmp/managed.pyz, /tmp/rope-*.pyz, and the local infection marker located at ~/.cache/.sys-update-check. Additionally, block known C2 domains, including check.git-service.com and t.m-kosche.com, at the network firewall level.
  • Broad Secret Rotation: If a compromised package version is detected in your environment, assume all local credentials, SSH keys, cloud tokens, and password manager vaults have been compromised and rotate them immediately.
  • The “Mini Shai-Hulud” supply chain campaign represents a watershed moment in software pipeline security. By combining the rapid, autonomous propagation of traditional network worms with the stealth of modern credential stealers and the leverage of ransomware partnerships, TeamPCP has redefined what a supply chain attack can achieve. Only by shifting left, hardening local developer environments, and implementing continuous behavioral monitoring can enterprises hope to defend their codebases against this next generation of digital extortion.

    (336 words)

    Let’s compute total word count:
    1238 + 118 + 336 = 1692 words.
    Still slightly over 1500.

    Posted in Security & Privacy, Threat Alerts | Tagged , , , | Leave a comment

    OpenAI Reasoning Model Disproves 80-Year-Old Erdős Conjecture

    On May 20, 2026, the global scientific community witnessed a watershed moment in both mathematics and computer science. OpenAI announced that an unreleased, internal general-purpose reasoning model had autonomously disproved the planar unit distance conjecture, an eighty-year-old open problem first posed by legendary Hungarian mathematician Paul Erdős in 1946. By constructing an elegant, highly original 125-page proof that successfully refuted the long-held Erdős conjecture, this artificial intelligence accomplished what decades of human mathematical brilliance could not. Rather than acting as a mere digital assistant, the system operated as an autonomous pioneer, fundamentally altering our understanding of discrete geometry and delivering a decisive blow to the skepticism that has long surrounded the reasoning limitations of large language models (LLMs). This achievement marks the first time a non-domain-specific neural network has solved a premier, long-standing open problem in pure mathematics.

    The Geometry of Points and the Erdős Conjecture

    To appreciate the scale of this breakthrough, one must understand the deceptively simple nature of the planar unit distance problem. Posed by Paul Erdős in his seminal 1946 paper, the problem asks a straightforward question: if you place n points on a flat, two-dimensional plane, what is the maximum number of pairs of points that can be exactly one unit of distance apart?

    For generations, the prevailing mathematical consensus was governed by geometric intuition. Erdős himself observed that a simple square grid of points—properly scaled—could produce a high density of unit distances. Based on these grid configurations, he formulated the Erdős conjecture, proposing that the maximum number of unit-distance pairs, denoted as ν(n), could grow no faster than:

    ν(n) ≤ n1 + c / log log n

    This upper bound, which translates asymptotically to n1+o(1), represents a growth rate that rises only marginally faster than a purely linear rate. For eight decades, this conjecture stood as a foundational pillar of discrete geometry. While mathematicians succeeded in establishing lower and upper bounds—most notably the O(n4/3) upper bound proven by Joel Spencer, Endre Szemerédi, and William Trotter in 1984—no one could find a point configuration that defied Erdős’s nearly-linear limit. The standard mathematical toolkit, heavily reliant on rescaled grids and classical geometric configurations, had reached an impasse, leaving researchers to believe that the limits of the physical plane simply forbade denser arrangements.

    Bridging Geometry and Algebraic Number Theory

    The OpenAI reasoning model shattered this eighty-year-old paradigm by completely abandoning the geometric avenues that had occupied human researchers for decades. Instead of attempting to optimize physical grid layouts, the AI recognized a profound, hidden connection between discrete planar geometry and deep algebraic number theory.

    At the heart of the model’s proof is a masterclass in modern algebra, utilizing the Golod-Shafarevich criterion—a landmark 1964 theorem in non-abelian class field theory—to construct an infinite family of planar point configurations. The mathematical pipeline devised by the model can be broken down into several highly complex steps:

    • Infinite Galois Towers: The model constructed an infinite, unramified tower of totally real number fields with 3-power Galois groups of growing degree. Within this tower, a carefully selected, fixed set of rational primes was forced to split completely.
    • Adjoining Complex Units: By adjoining the imaginary unit i to these fields, the model generated high-dimensional lattices. These lattices contained an extraordinary abundance of elements whose images under every complex embedding possessed an absolute value of exactly one.
    • Controlling Growth: Using Golod-Shafarevich theory, the model proved the existence of an infinite tower even after executing a quotient step to render the prescribed Frobenius classes trivial. This ensured that the resulting discriminants and class numbers grew at most exponential relative to the extension degree.
    • Planar Projection: Finally, by projecting these multidimensional lattice points onto the complex plane, the model demonstrated the existence of point sets where the number of unit-distance pairs grew at a polynomial rate of n1+ε.

    Following the release of the proof, Princeton mathematician Will Sawin meticulously analyzed the model’s construction. He calculated the exact polynomial gain, determining the exponent improvement to be ε ≈ 0.014. By proving that the number of unit distances can scale at a rate of roughly n1.014, the model successfully refuted the Erdős conjecture and demonstrated that algebraic constructions in number fields can systematically outperform traditional geometric grids.

    Redemption and Validation by the Harshest Critics

    In the world of pure mathematics, claims of solving legendary problems are met with extreme scrutiny. This skepticism was doubly intense for OpenAI. In October 2025, Kevin Weil, then leading the OpenAI for Science division, hastily announced on social media that a frontier model had solved ten unsolved Erdős puzzles. However, Thomas Bloom, a University of Manchester mathematician who maintains the authoritative erdosproblems.com registry, quickly exposed the claim as a “dramatic misrepresentation”. The model had not generated new mathematics; it had merely retrieved existing solutions from historical literature and framed them as novel discoveries.

    The May 2026 announcement, however, was fundamentally different. Rather than relying on corporate marketing, OpenAI pre-empted criticism by releasing the raw 125-page proof alongside a comprehensive companion verification paper. Most remarkably, the co-authors of this verification paper included nine of the world’s most prominent mathematicians—including Thomas Bloom himself.

    The verification team also featured Fields Medalist Timothy Gowers, who praised the elegance and logical robustness of the AI’s proof. Gowers went so far as to state that he would recommend the paper for publication in the prestigious Annals of Mathematics without hesitation. The co-authorship of elite minds such as Noga Alon, Daniel Litt, Arul Shankar, Jacob Tsimerman, Victor Wang, and Melanie Matchett Wood provided an absolute, ironclad seal of scientific legitimacy, transforming what could have been another public relations blunder into a historic milestone.

    The Death of the “Stochastic Parrot” Narrative

    For years, a vocal contingent of computer scientists and linguists argued that large language models were merely “stochastic parrots”—glorified statistical engines capable of compressing and recombining human text, but fundamentally incapable of genuine reasoning, creative problem-solving, or expanding the boundaries of human knowledge. Critics asserted that because neural networks are trained on historical data, they could never transcend their training distributions to produce truly novel, complex ideas.

    The resolution of this discrete geometry problem forcefully dismantles that paradigm. The OpenAI model did not merely interpolate between existing papers; it synthesized a highly sophisticated bridge between two disparate fields of mathematics—algebraic number theory and discrete geometry—that human experts had never thought to connect in this specific manner.

    Furthermore, the proof was generated in a “one-shot” pipeline, meaning the model produced the core mathematical architecture autonomously, without iterative human prompting, scaffolding, or step-by-step guidance. Leading number theorist Arul Shankar noted that this achievement marks a profound transition in the field of artificial intelligence: LLMs are officially shifting from passive research assistants that format code or search literature into active, autonomous intellectual entities capable of executing world-class scientific breakthroughs.

    A New Frontier for AI and Human Mathematics

    As the dust settles on this historic discovery, the broader implications for the future of scientific inquiry are staggering. This milestone represents a practical demonstration of how general-purpose reasoning models can serve as engines of discovery. By utilizing advanced chain-of-thought processing to break down monumental problems into granular, logically sound sub-steps, AI systems are now capable of navigating complex intellectual mazes that have stymied human minds for generations.

    While the ultimate resolution of the planar unit distance problem remains open—since the AI did not establish a new absolute upper bound, but rather proved that the 80-year-old lower limit was incorrect—the methodology it introduced has completely redrawn the mathematical map. Mathematicians are now eagerly exploring the “number-field loophole” exposed by the model to see if other classical problems in discrete geometry, such as the Hadwiger-Nelson problem, can be unlocked using similar algebraic structures.

    Ultimately, the disproof of the Erdős conjecture is more than just a victory for mathematics; it is a preview of a future where human intellect and machine reasoning merge to conquer the unsolvable. We have entered an era where the next great scientific revolution may not be authored by a human holding a chalk, but by a machine quietly processing a prompt.

    Posted in Artificial Intelligence, Technology & AI | Tagged , , , | Leave a comment

    Data Sharing Dark Patterns: How Platforms Block Opt-Out Requests

    For years, tech companies have pacified privacy advocates by claiming that consumer autonomy is the cornerstone of the digital economy. If you do not want your personal life packaged, profiled, and monetized, they argue, the power to stop it is in your hands. However, a groundbreaking study released on May 20, 2026, by the Electronic Privacy Information Center (EPIC) exposes this narrative as a carefully engineered falsehood. Titled Good Luck Opting Out: Manipulative Design Patterns in Opt-Out Processes, the report systematically documents how prominent platforms employ deceptive user interfaces—colloquially known as “dark patterns”—to actively block users from halting corporate data sharing.

    The study analyzed the privacy settings and opt-out workflows of 38 prominent companies, spanning data brokers, social media platforms, dating apps, and artificial intelligence leaders. Despite comprehensive consumer privacy laws in 21 U.S. states designed to guarantee clear and easy-to-use opt-out mechanisms, EPIC’s findings reveal a grim reality: compliance is treated not as a legal mandate, but as a design loophole. By utilizing manipulative user experiences, tech conglomerates and data brokers systematically frustrate, confuse, and discourage individuals attempting to reclaim control of their digital footprints.

    The Eight Tactics Weaponized to Enforce Data Sharing

    According to the report, co-authored by EPIC Scholar in Residence Justin Sherman and EPIC Counsel Caroline Kraczon, manipulative design patterns are deliberate, coercive choices structured to undermine user intent. The study identified eight primary manipulative patterns utilized across the industry to keep data sharing active on the backend:

    • Failing to Provide a Clear Mechanism: Many platforms fail to offer any obvious method for users to stop the sale or transfer of their personal information, forcing consumers to search endlessly for non-existent controls.
    • Hiding the Opt-Out in Plain Sight: More than a dozen analyzed platforms—including Meta, Google, and OpenAI—failed to clearly link their opt-out forms on their homepages or privacy policies, forcing users to dig through convoluted hierarchies of menus.
    • The Friction Trap: Instead of a single “opt-out of all” setting, platforms segment their controls, forcing consumers to submit multiple separate forms for different categories of tracking. This “DSR friction” leverages user fatigue to ensure form abandonment.
    • Deceptive Messaging: Platforms deploy defeatist statements to make users believe opting out is futile. The data broker Spokeo, for example, warns that “your information may reappear… without notice,” shifting the burden onto the user to constantly monitor their records.
    • Confusing or Scary Language: Interfaces utilize emotionally manipulative warnings, falsely implying that restricting data sharing will degrade safety features or render the service unusable.
    • Paywalls and Mandatory Logins: Several platforms require users to register an account or purchase a premium subscription before opting out. This forces individuals to exchange more sensitive data or money just to secure their privacy rights.
    • Visual Deception and Misdirection: Companies use greyed-out buttons to mimic disabled functions, hide essential disclosures under collapsible text, or design asymmetric choice screens where the “Accept All” button is prominent and “Reject” is obscured.
    • Preselected Default “Opt-Ins”: Ride-hailing platforms like Uber and Lyft, and dating apps like Grindr and Bumble, have the “opt-in” checkbox selected by default on their privacy pages, requiring users to manually toggle them off to prevent active data sharing.

    The Chilling, Real-World Consequences of Manipulative Design

    The use of dark patterns to maintain aggressive data sharing is not merely a user experience annoyance. As Caroline Kraczon emphasized, these manipulative interfaces have devastating real-world impacts, leaving vulnerable populations exposed to severe physical threats like stalking, doxxing, and targeted harassment.

    The EPIC report highlights a horrifying tragedy in Minnesota that underscores the life-and-death stakes of unregulated personal information. In 2025, an individual allegedly murdered Minnesota state legislator Melissa Hortman and her husband Mark, while also critically wounding another legislator and his wife. The subsequent investigation revealed that the perpetrator had utilized “people search” data brokers to extensively research and locate his targets.

    When data brokers make it nearly impossible to opt out, they become passive accomplices to this kind of surveillance. This risk does not affect everyone equally. The report emphasizes that marginalized communities—disproportionately women, women of color, and LGBTQ+ individuals—suffer the most when platforms block simple opt-out commands. For domestic abuse survivors and marginalized youth, keeping location histories off the open market is a matter of basic safety.

    The Regulatory Battleground: Why State Laws Are Failing

    To date, 21 U.S. states have enacted comprehensive data privacy laws designed to give consumers the right to opt out of the sale and sharing of their personal information. On paper, these laws are hailed as major victories, explicitly requiring businesses to provide clear, conspicuous, and easy-to-use opt-out mechanisms. However, the EPIC audit proves that compliance is often reduced to a design loophole.

    The fundamental flaw lies in the reliance on the outdated “notice-and-choice” framework. By placing the burden of privacy on the individual, state laws expect consumers to manually visit dozens of websites, decode complex legal policies, and successfully navigate manipulative opt-out screens. This is an impossible task for the average citizen, and as the EPIC report concludes, consumers cannot effectively protect their own privacy under this model.

    Despite this, 2026 has marked a critical transition from law creation to aggressive law enforcement. State attorneys general and federal regulators are beginning to target “DSR friction” and asymmetric choice design. Notable recent enforcement actions highlight this shifting tide:

    • The Honda Settlement (2025): Regulators penalized automotive giant Honda for maintaining asymmetric cookie controls, where opting into tracking was frictionless while opting out required overcoming significant interface hurdles.
    • Healthline Media (2025): The health-focused media company was fined over $1.5 million for failing to honor universal opt-out signals and misusing sensitive health data for targeted advertising.
    • Tractor Supply: Faced heavy regulatory scrutiny and enforcement for failing to honor opt-out rights and using dark patterns that coerced consumers into agreeing to the sale of their data.

    Forging a Path Forward: Universal Opt-Outs and Data Minimization

    To dismantle the predatory economy of dark patterns, EPIC argues that policymakers and regulators must move past individual opt-outs and implement systemic, structural reforms. The report outlines several clear recommendations to restore digital autonomy to the public:

    First, regulators must demand the implementation of “symmetry-in-choice”. If a website provides a prominent, one-click button to “Accept All” tracking, it must provide an equally prominent, identical-looking one-click button to “Reject All” on the very same screen. This simple rule would immediately eliminate the vast majority of visual misdirection and preselected default traps.

    Second, state and federal authorities must mandate support for universal opt-out preference signals, most notably the Global Privacy Control (GPC). Instead of forcing a user to manually navigate the manipulative settings of every website they visit, the GPC sends an automated, machine-readable signal from the browser to every site, executing a “Do Not Sell or Share” command instantly. Currently, 12 U.S. states legally require companies to recognize and honor these universal preference signals.

    Third, other states must follow the lead of California’s landmark Delete Act (SB 362). On January 1, 2026, California launched its first-of-its-kind Delete Request and Opt-Out Platform (DROP). Operated by CalPrivacy (the California Privacy Protection Agency), DROP acts as a centralized government portal allowing residents to submit a single, free request that automatically triggers deletion and opt-out demands across more than 500 registered data brokers at once. Under the law, data brokers are required to retrieve and process these DROP requests starting August 1, 2026, or face compounding daily fines of $200 per request per day. This centralized solution strips data brokers of their ability to hide behind custom-built, frustrating user interfaces.

    Ultimately, the Federal Trade Commission (FTC) must utilize its Section 5 authority—which prohibits unfair and deceptive business acts or practices—to declare manipulative design patterns in opt-out flows as a direct violation of federal law. But even these steps are mere band-aids. The ultimate solution, as advocated by EPIC, is a national transition to strict data minimization standards. Under a data minimization framework, companies are legally prohibited from collecting, sharing, or retaining any consumer data that is not strictly necessary to deliver the specific service requested. By default, corporate data sharing would be restricted, shifting the burden of protection off the shoulders of the consumer and onto the corporations where it belongs. Until regulators enforce a “minimization by default” architecture, the internet will remain a hostile digital environment where corporate profit is prioritized over physical and digital safety.

    Posted in Security & Privacy, Social Media & Big Tech | Tagged , , , | Leave a comment

    GitHub Code Breach: TeamPCP and the Shai-Hulud Worm Explained

    In the high-stakes theater of modern cyber warfare, few incidents have exposed the fragility of our digital infrastructure as starkly as the recent GitHub code breach. On May 19, 2026, the tech sector was thrown into a state of high alert as GitHub officially confirmed that a sophisticated threat actor group had bypassed its perimeter security, culminating in the exfiltration of roughly 3,800 proprietary GitHub-internal repositories. Orchestrated by a financially motivated cybercrime cluster known as TeamPCP (tracked by Google Threat Intelligence Group as UNC6780), the attack leveraged a specialized, self-propagating worm that has redefined the boundaries of software supply chain operations.

    Understanding the Anatomy of the GitHub Code Breach

    The sequence of events that led to this catastrophic compromise is a masterclass in how modern attackers exploit the “developer trust surface.” The breach did not rely on complex zero-day exploits targeting GitHub’s cloud architecture. Instead, it weaponized the implicit trust developers place in their local integrated development environments (IDEs)—specifically Microsoft’s Visual Studio (VS) Code.

    The timeline of the initial intrusion was compressed into a razor-thin window on May 18, 2026. TeamPCP leveraged OpenID Connect (OIDC) credentials and GitHub CLI OAuth tokens, stolen from a previous high-profile compromise of the popular TanStack open-source ecosystem, to authenticate as verified contributors. With this high-level access, they published a backdoored update of the highly popular VS Code extension, Nx Console (v18.95.0, under the publisher nrwl.angular-console), which boasts more than 2.2 million installations globally.

    The malicious update was only live on the official Microsoft VS Code Marketplace for a fleeting 11 to 18 minutes before being detected and pulled by the Nx development team. However, due to the widespread industry practice of enabling auto-updates for IDE extensions, this narrow window was more than sufficient to trigger automatic downloads across thousands of developer workstations. Among those compromised was a local machine belonging to a GitHub developer. Because VS Code extensions operate with the full security privileges of the logged-in user, the execution of this single extension granted the attackers direct access to the employee’s machine, opening the floodgates for the eventual GitHub code breach.

    The Technical Mechanics of the Shai-Hulud Worm

    At the heart of TeamPCP’s campaign is a highly advanced, fully wormable threat ecosystem named Shai-Hulud, an explicit nod to the colossal, subterranean sandworms of Frank Herbert’s Dune universe. Unlike traditional supply chain attacks that rely on passive typosquatting, Shai-Hulud is designed to actively propagate, turning every infected host into a launchpad for further compromises. First identified in late 2025, the worm has evolved through several iterations, with the “Mini Shai-Hulud” variant deployed in the May 2026 campaign representing its most lethal version to date.

    The operational lifecycle of the Shai-Hulud worm is divided into several highly automated stages:

    • Execution and Runtime Smuggling: Upon installation of a compromised package or extension, the worm executes during the preinstall or prepare phases using the lightweight bun JavaScript runtime. If Bun is not present on the victim’s machine, the malware silently installs it to bypass Node.js-specific monitoring tools.
    • Deep Credential Harvesting: The payload executes an extensive sweep targeting over 20 distinct credential types. It searches local directories, environment variables, and configuration files for AWS, Azure, Google Cloud, HashiCorp Vault, Kubernetes service tokens, SSH keys, npm publishing tokens, and cryptocurrency wallets.
    • Memory Scraping: In continuous integration and continuous deployment (CI/CD) environments, the worm reads the local GitHub Actions Runner’s .Worker process memory directly via /proc/<pid>/mem to extract masked, plaintext OIDC tokens and API secrets in real-time.
    • AI Assistant Compromise: Proving its adaptability, the worm specifically targets the local configuration files of emerging artificial intelligence development tools, successfully harvesting credentials from Anthropic’s Claude Code (such as ~/.claude/settings.json).

    Once Shai-Hulud successfully harvests these credentials, it initiates a self-propagation routine. Using the newly stolen npm publishing tokens and GitHub Personal Access Tokens (PATs), the worm automatically logs into the victim’s developer accounts, identifies other legitimate packages maintained by that developer, injects its own malicious code, and publishes updated versions to public registries. This creates a compounding, exponential infection loop that bypasses conventional security filters.

    The Poetry of Covert Exfiltration and Dead-Drops

    TeamPCP’s operational sophistication is matched by their deliberate use of dramatic hacker lore and counter-forensic techniques. The Shai-Hulud payload does not simply dump stolen secrets to a standard command-and-control (C2) server. It utilizes a highly resilient, multi-tiered exfiltration network designed to bypass traditional egress filtering.

    The primary exfiltration path utilizes an obfuscated HTTPS connection disguised as legitimate OpenTelemetry (OTel) traffic, routing data to a remote collector endpoint at t.m-kosche.com. If this network connection is blocked or fails a pre-flight health check, the worm deploys a fallback mechanism that exploits the target’s own infrastructure. Using the stolen GitHub tokens of the victim, Shai-Hulud programmatically creates public GitHub repositories under the victim’s personal account. The harvested secrets are serialized, compressed via Gzip, encrypted using AES-256-GCM, wrapped with RSA-4096-OAEP, and committed as JSON files to these newly minted repos.

    In a cheeky nod to its sci-fi namesake, the worm automatically formats the metadata of these exfiltration repositories as follows:

    1. The repositories are assigned random, Dune-themed names generated from custom word lists, such as atreides-lasgun-393 or gesserit-fedaykin-112.
    2. The repository description is set to a character-reversed string: niagA oG eW ereH :duluH-iahS, which, when read backwards, translates to “Shai-Hulud: Here We Go Again”.

    By creating thousands of these Dune-themed public repositories, the attackers establish a decentralized, highly visible, yet incredibly difficult-to-block dead-drop network. The threat actors can simply query the public GitHub Search API for the reversed beacon string to identify and download their encrypted spoils.

    The Persistent “Kitty” Backdoor

    To ensure long-term access that survives local system reboots and credential rotation, Shai-Hulud drops a persistent, Python-based C2 backdoor onto compromised endpoints. On Unix-like systems, the malware creates a file at ~/.local/share/kitty/cat.py and registers it via a macOS LaunchAgent (such as com.user.kitty-monitor.plist) or a Linux systemd user service to trigger hourly.

    This “Kitty” backdoor establishes persistence through an incredibly stealthy, signature-verified polling system. Instead of maintaining an active TCP socket to a malicious IP address, cat.py queries the official GitHub Search API (api.github.com/search/commits) every hour, searching for a specific keyword: firedalazer. The attackers can push a public commit containing this keyword to any arbitrary, benign repository on GitHub. The commit message contains encrypted, signed commands. The backdoor downloads the commit, validates the cryptographic signature using a hardcoded 4096-bit RSA public key, and executes the payload. This completely decouples the attackers’ infrastructure from the infected machines, rendering IP-based firewall blocks useless.

    The Underground Market and Cybercrime Synergies

    Following the successful exfiltration of the 3,800 GitHub-internal repositories, TeamPCP shifted from technical execution to financial monetization. The stolen codebase—comprising proprietary algorithms, internal tooling, and potentially sensitive architectural configurations—represents a crown jewel in the cybercrime underground.

    Initially, TeamPCP listed the exfiltrated codebase on the notorious illicit marketplace BreachForums, setting a starting bid of $50,000. However, recognizing the massive scale of the exploit, they quickly scaled their extortion efforts. The group formed a tactical partnership with affiliates of the infamous Lapsus$ cybercrime syndicate to broker the sale. The data was subsequently listed on Lapsus$’s dedicated data leak portal with an increased price tag of $95,000, attracting intense interest from state-sponsored actors and rival threat groups eager to dissect GitHub’s internal mechanics.

    Lessons from the Breach: Securing the IDE and Registry Pipeline

    The fallout of the GitHub code breach has sent shockwaves through the global software engineering community. It has exposed a critical, systemic vulnerability in how modern organizations secure their development environments. For years, cybersecurity paradigms have focused heavily on protecting production servers, cloud databases, and external-facing APIs, while treating the local developer workstation as a secure, trusted enclave.

    As this incident proves, the developer workstation is actually the soft underbelly of the enterprise. To prevent future supply chain compromises of this scale, organizations must fundamentally re-engineer their security frameworks by adopting several critical mitigations:

    • Deactivate Extension Auto-Updates: Enterprises must mandate that IDE extensions, such as those on the VS Code Marketplace or Open VSX, are pinned to specific, audited versions rather than allowing automatic, unverified updates.
    • Enforce Sandboxed IDE Environments: Developer environments should run within isolated containers or virtualized workspaces with restricted local system access, preventing extensions from scraping system memory or local keystores.
    • Implement Strict Egress Filtering: Security teams should strictly monitor and restrict outbound connections from developer endpoints, explicitly blocking unauthorized DNS tunneling, non-standard HTTPS requests, and unapproved API interactions with public code registries.
    • Establish Immediate Credential Rotation Playbooks: In the event of a suspected supply chain compromise, organizations must have automated mechanisms to instantly revoke and rotate all active developer credentials, including npm tokens, GitHub PATs, and cloud provider OIDC configurations.
    Posted in Internet Curiosities, Resources & Culture | Tagged , , , | Leave a comment