short notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
ALPR networks let a single query reach tens of thousands of cameras, and connected cars stream position data to brokers. FTC enforcement, leaked audit logs and documented stalking cases show why vehicle location should be treated as permanently compromised.
Gift cards need no bank account and no identity check at redemption, which makes them a durable cash-out rail for cybercrime. A look at the resale economics, the documented enforcement cases, and why the model survives the friction.
Middle relays carry Tor traffic between the first and last hop without ever connecting to the public internet. What the tier actually does, why network health depends on it, and what running one involves.
Google has taken legal action against the command-and-control servers of x.cpe, a firmware backdoor that TrendAI counted on 1,472,554 Android devices across 206 models. Google says Shenzhen manufacturer Videostrong built and sold access to the botnet, and has banned the company from certified Android hardware.
An estimated 6.3 to 6.43 billion dollars drained from Binance hot wallets on October 29, 2026, across eleven blockchains. The FBI attributes the theft to North Korea's TraderTraitor cluster, the same actors behind the Bybit heist; Binance says it is covering every customer loss while the laundering effort runs for years.
Fake recruiters on LinkedIn and fake interview sites turn job applications into malware infections. A look at the documented campaigns — Operation DreamJob, Contagious Interview, Graphalgo — their red flags, and what to check before running any coding test.
Underground forums advertise SIM-swapping jobs at $2,000 to $5,000 per number, with a premium when an insider is already in place at the carrier. The pricing, the court cases behind it and the defenses that work.
Tor's money once came mostly from the US government; today it is a mix of State Department grants, foundations, companies and small donors. A look at what the project's own reports and 990s actually show.
Cisco Talos has documented a Windows infostealer that sends each victim's stolen data to OpenRouter models and asks for a ranked assessment of what the person is worth and how good their opsec is. The sample ships as a per-customer build with no attacker-owned infrastructure.
Tor bridges only work while censors do not know them, so their distribution is deliberately rationed. A look at BridgeDB's retirement, the rdsys successor, the Moat captcha, email and Telegram channels, and why bridge scarcity is a feature, not a flaw.
Adversary-in-the-middle kits relay one-time codes and session cookies in real time, but a passkey is bound to the single domain that issued it, so the proxy gets nothing to relay. A look at why the mechanism holds, where it still falls short, and how far adoption has come.
Qilin, once a small Go-based brand called Agenda, has become one of the most active ransomware operations worldwide. A look at its Rust loader, its kernel-level EDR killer, the Synnovis and Lee Enterprises attacks, and what 2,398 leak-site victims reveal.
