short, practical notes about not getting phished. no fear mongering, just the checklist.
DRAM holds its contents for seconds to minutes after power-off, longer when chilled, and full-disk encryption keys are usually among them. What the 2008 Princeton work showed, what modern memory scrambling does not fix, and the mitigations Tails actually ships.
Roughly half of the people who find a dropped USB drive plug it in and open files - a field experiment measured 48 percent. A look at the history of the ploy, the study behind the numbers, modern bait hardware and the rules that actually help.
Browser extensions listed in official stores have repeatedly worked as credential and cookie stealers. A look at documented campaigns, the review gap that lets approved packages change behavior after approval, and a practical defense routine.
Stolen records rarely travel straight from a breach to the tool that abuses them. Brokers, aggregators, enrichers and repackagers keep the material moving, and every stage of that chain has a point where defenders can break it.
ALPR networks let a single query reach tens of thousands of cameras, and connected cars stream position data to brokers. FTC enforcement, leaked audit logs and documented stalking cases show why vehicle location should be treated as permanently compromised.
Google has taken legal action against the command-and-control servers of x.cpe, a firmware backdoor that TrendAI counted on 1,472,554 Android devices across 206 models. Google says Shenzhen manufacturer Videostrong built and sold access to the botnet, and has banned the company from certified Android hardware.
Fake recruiters on LinkedIn and fake interview sites turn job applications into malware infections. A look at the documented campaigns — Operation DreamJob, Contagious Interview, Graphalgo — their red flags, and what to check before running any coding test.
Cisco Talos has documented a Windows infostealer that sends each victim's stolen data to OpenRouter models and asks for a ranked assessment of what the person is worth and how good their opsec is. The sample ships as a per-customer build with no attacker-owned infrastructure.
Adversary-in-the-middle kits relay one-time codes and session cookies in real time, but a passkey is bound to the single domain that issued it, so the proxy gets nothing to relay. A look at why the mechanism holds, where it still falls short, and how far adoption has come.
EXIF GPS coordinates, PDF producer strings and Word author fields have ended more pseudonymous careers than any exploit. A look at the documented cases, and at what actually removes metadata and what only looks like it does.
End-to-end encryption protects message content, but delivery still leaves traces: connection times, IP addresses and identifiers. A plain look at what Signal, SimpleX, Session and federated XMPP actually see, and where published disclosures back the claims.
Fake "Airport_Free_WiFi" hotspots and counterfeit captive portals remain a real travel risk. Australian prosecutions for evil-twin Wi-Fi at airports and on domestic flights show what the trick harvests, what HTTPS stops, and what it does not.
