Instagram @-Mentions Are Now an AI Impersonation Surface
Meta's Muse Image turns public Instagram content into promptable visual context. The security issue is not novelty; it is lower-friction impersonation at social-media scale.
Security Research & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team research, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest research
Archive
Recent posts
Jolla Phone in 2026: Privacy Phone or Threat Model Correction?
Jolla's new Finnish phone is a useful reminder that mobile privacy is not one feature. It is an architecture, an app ecosystem, a supply chain, and a set of user tradeoffs.
Prompt Injection in 2026: From Research Toy to Real CVEs, Agent Hijacking, and Zero-Click Exfiltration
CVE-2025-32711 (EchoLeak) exfiltrated M365 data with zero user interaction. The Anthropic MCP server had three exploitable injection CVEs. OpenAI says AI browsers may never be fully fixed. Here's the full attack chain — and how to detect it.
WhatsApp Usernames: A Privacy Win That Opens a New Impersonation Surface
WhatsApp usernames reduce phone-number exposure, but they also create a new global namespace where brands, public bodies, and lookalike handles can become fraud infrastructure.
The VPN Was Never the Problem: How a Windows Telemetry ID Unmasked a Scattered Spider Suspect
A 19-year-old allegedly hid behind a VPN and ngrok during an $8M jewelry-retailer extortion case. Windows' Global Device Identifier (GDID) gave investigators a device-level pivot.
AI-Built Browser Ransomware Abuses Chrome File Access
Check Point analyzed a DeepSeek-attributed ransomware sample that should not work from a browser tab. Most of it was fiction — except for one detail that mapped to a real Chromium API. No malware install required.
Minimum Package Age: The Supply Chain Control That Buys Defenders Time
Fast takedowns do not protect systems that auto-install malicious packages or extensions in the first minutes after release. Minimum package age turns time into a practical supply chain defense.