← Feed

Posts

• View post

  ~ Personal news ~  I left TechCrunch a few days ago. First, I will now focus on finishing my book about Hacking Team and the history of government spyware. After that, and in the meantime as well, I will be freelancing. So if you are looking for some cool stories about cybersecurity and surveillance; or help researching and reporting for a larger project, and similar services, please let me know. You can contact me via email: Lorenzofb.writes@gmail.com or via Signal: @LorenzoFB.1337 (+1 917...

• View post

  NEW: Another AI model escaped its supposedly isolated environment in a cybersecurity test. This time it was the model Kimi K3, made by Chinese company Moonshot. At least this time it didn't hack anyone. This is the latest incident of its kind after incidents at OpenAI, Anthropic, Meta and AISI. https://techcrunch.com/2026/08/07/chinese-ai-model-kimi-escaped-its-cybersecurity-testing-environment-researchers-say/

• View post

  NEW: Connor Moucka, 26-year-old Canadian, pleaded guilty to hacking more than 165 companies, most of them customers of cloud provider giant Snowflake, including AT&T and Ticketmaster. DOJ said Moucka made around $3 million from ransom payments and from selling personal data on hacking forums. https://techcrunch.com/2026/08/06/hacker-pleads-guilty-to-stealing-data-from-more-than-165-snowflake-customers

• View post

  NEW: Several hackers have been stealing $130 million — and counting — in Bitcoin from the owners of supposedly secure offline hardware wallets.  The heists rely on a security flaw in the Coldcard wallet. By knowing how to make the keys, the hackers did not need to break into the safe that holds them. The cybercriminals essentially figured out how to cut keys at scale. “Perhaps the hardest part about this is that I did everything right,” Jonathan Goodman, who claimed to have had $1.6 million st...

• View post

  NEW: After the UK government sent a secret legal request to access users’ encrypted iCloud data, Apple has reportedly filed a new legal challenge against it. This is the latest in a legal fight that started early last year. Critics see these demands as a threat to Apple users worldwide.  https://techcrunch.com/2026/08/03/apple-challenges-uk-governments-latest-demand-for-icloud-backdoor-report/

• View post

  NEW: Since the advent of LLMs experts have warned that AI would usher in an era of countless bugs, putting pressure on defenders to keep up with hackers. We are starting to see hard data backing up that prediction. In just one month, Google fixed as many bugs in Chrome as in the previous two years. http://techcrunch.com/2026/07/30/google-says-it-fixed-more-chrome-bugs-in-june-than-over-the-past-two-years-thanks-to-ai/

• View post

  This is a great explainer of the OpenAI hack against Hugging Face, particularly of the report that the latter published earlier this week. If you had trouble parsing the highly technical report, this article can walk you through it. https://techcrunch.com/2026/07/29/the-hugging-face-ai-break-in-as-told-through-an-increasingly-committed-bear-metaphor/

• View post

  NEW: I delved into the mystery of Phineas Fisher, probably the most prolific and public hacker never to have gotten caught. This is what we know about the infamous hacktivist and their spectacular hacks against spyware makers FinFisher and Hacking Team. There will be even more in my upcoming book. https://techcrunch.com/2026/07/25/the-hacker-who-humiliated-spyware-makers-and-was-never-caught/

• View post

  NEW: I spoke to several offensive cybersecurity researchers, including zero-day developers, about how the guardrails imposed by OpenAI and Anthropic on their AI models are getting in the way of their work. Most complained that the guardrails are inconsistent and too strict, which pushes them to use open source models instead.  https://techcrunch.com/2026/07/23/how-ai-guardrails-are-impeding-the-work-of-offensive-cybersecurity-researchers/

• View post

  Zero-day startup Paradigm Shift took down the blog post and corresponding Proof-of-Concept code for the iPhone flaw they dubbed Usbliter8. Takedown comes following a judge order in the lawsuit filed by Magnet Forensics, which alleges a former employee now at the startup stole the flaw.

• View post

  NEW: The FBI arrested a 21-year-old student accused of uploaing malware-laden video games on Steam, infecting thousands of victims, and then stealing $220,000 in crypto from some of them. The man, Zyaire Wilkins, worked with unnamed co-conspirators to publish at least five malware-embedded games. https://techcrunch.com/2026/07/17/fbi-arrests-man-accused-of-using-steam-games-to-drain-victims-crypto-wallets/

• View post

  Very interesting detial in NSO Group's training materials for customers: "Pegasus training material describes situations where it may not be possible to attack a target directly, for example if they do not use a smartphone or are highly security conscious in how they use their device. In those circumstances, NSO Group suggests expanding to 'close-circle infection,' targeting others connected to the target, potentially including colleagues, friends or family members of the prima...

• View post

  NEW: Cops say the arrest of two members of the infamous Scattered Spider hacking group have halted the gang’s activities.  On Thursday, two members of Scattered Spider were sentenced to five years and a half in prison for hacking London’s transportation system in 2024.  https://techcrunch.com/2026/07/16/uk-cops-say-arrest-of-two-young-hackers-disrupted-the-operations-of-an-infamous-hacking-group/

• View post

  NEW: The Iranian government abused well-known flaws in the global telecoms infrastructure — specifically SS7 — to locate U.S. military personnel in the Middle East at the beginning of the war. https://techcrunch.com/2026/07/14/iran-abused-mobile-networks-vulnerabilities-to-locate-u-s-military-in-the-middle-east-report-says/

• View post

  NEW: In a major privacy win, the U.S. Supreme Court has ruled that authorities need to get a search warrant when requesting historical "geofence" cellphone location data. Feds will need to show probable cause when requesting these type warrants, the court ruled, as "an individual has a reasonable expectation of privacy in his cell-phone location information.” The Supreme Court ruled that historical cellphone location data, even if collected by a third party such as Google, is pr...

• View post

  NEW: Apple fixed the bug that law enforcement agencies, like the FBI, were taking advantage of to extract chat messages that had been deleted or disappeared automatically. Until now the iPhone stored deleted or disappered messages in a database, allowing authorities to access them with forensic tools. http://techcrunch.com/2026/04/22/apple-fixes-bug-that-cops-used-to-extract-deleted-chat-messages-from-iphones/

• View post

  NEW:** **Google is rolling out a new security feature for Android called Intrusion Logging, which is designed specifically to help security researchers investigate attacks done with spyware and forensic tools. Amnesty, who worked with Google in developing the feature, says this is ““a fundamental shift in the amount and quality of forensic data available on Android devices.”  https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks...

• View post

  NEW: U.S. bank Community Bank says customer data, including names, dates of birth, and Social Security numbers, was exposed due to “an unauthorized artificial intelligence-based software application.” The bank has not disclosed how many customers are affected. https://techcrunch.com/2026/05/12/u-s-bank-disclose-security-lapse-after-sharing-customer-data-with-ai-app/

• View post

  NEW: Polish intelligence says hackers broke into 5 water treatment systems, and could have tampered with the safety of water supply. Poland did not accuse Russia for these attacks, but it said the Russian government has been targeting military and civilian infrastructure — a threat the U.S. and other Western countries face too. https://techcrunch.com/2026/05/08/poland-says-hackers-breached-water-treatment-plants-and-the-u-s-is-facing-the-same-threat/

• View post

  NEW: Researchers have identified extensive spying campaigns abusing well-known weaknesses in the global cellphone infrastructure to track and locate targets. Two (unnamed for now) surveillance vendors, whose customers are likely government agencies, were allegedly behind these spy campaigns. The research exposes an industry that remains still largely in the shadows, armed with tech that can track people without the need to use spyware such as Pegasus. http://techcrunch.com/2026/04/23/survei...

• View post

  I spoke with @josephcox for a 404 Media podcast about the zero-day industry, the incredible case of the L3Harris executive who leaked hacking tools to a Russian broker, and what happened to those hacking tools afterward. Check it out here or on whatever podcast app you use. https://www.404media.co/government-hacking-tools-are-now-in-criminals-hands-with-lorenzo-franceschi-bicchierai/

• View post

  NEW: Chinese national Xu Zewei was extradited to the United States this weekend, according to his lawyer. Xu is accused of working for the Chinese government hacking group Hafnium, which was allegedly behind the hack of thousands of Microsoft Exchange servers, as well as stealing COVID-19 research from U.S. universities. https://techcrunch.com/2026/04/27/hacker-who-allegedly-carried-out-cyberattacks-for-china-is-extradited-to-u-s/

• View post

  NEW: Hackers are still exploiting a critical bug in web hosting software cPanel to take control of thousands of websites. The flaw was disclosed almost a week ago but thousands of sites have yet to patch it. According to Shadowserver, there are around 2,000 likely compromised websites as of today. https://techcrunch.com/2026/05/04/hackers-are-still-exploiting-the-cpanel-bug-to-gain-control-of-thousands-of-websites/

• View post

  NEW: Last week, ed tech giant Instructure confirmed a data breach of some student data. Cybercrime gang ShinyHunters claimed responsibility and shared with us a sample of the allegedly stolen data from two U.S. schools. It contained students’ names, their personal email addresses, and messages. https://techcrunch.com/2026/05/05/hackers-steal-students-data-during-breach-at-education-tech-giant-instructure/

• View post

  NEW: AI evaluation startup Braintrust confirmed a data breach affecting one of its AWS accounts, which contained API keys used by customers for accessing cloud-based AI models. The startup asked all its customers to revoke and replace their API keys "out of an abundance of caution." https://techcrunch.com/2026/05/06/ai-evaluation-startup-braintrust-confirms-breach-tells-every-customer-to-rotate-sensitive-keys/

• View post

  🚨 HOT TAKE 🚨: I think nobody should ever ever ever use the expression "threat actor" except in technical reports or writeups designed to be read among industry insiders. In news articles let's just use "hacker." I don't see a need to use the boring and for average people confusing "threat actor."

• View post

  NEW: A hacktivist (@back2theRoot) dressed as Pink Ranger from the Power Rangers wiped three white supremacist websites on stage at the end of a talk at Chaos Communication Congress (39C3). The hacker also published users’ data, including full profiles with pictures and geolocation, on the website okstupid.lol. The three racist websites are still down, a week after the live hack. http://techcrunch.com/2026/01/05/hacktivist-deletes-white-supremacist-websites-live-on-stage-during-hacker-confer...

• View post

  NEW: Paragon is not collaborating with Italian prosecutors investigating the spyware attacks against journalists and activists in the country, according to a report. Last year, Paragon publicly called out the Italian government for refusing its offer to collaborate with inquiries into the scandal. Now, the company is being silent. http://techcrunch.com/2026/04/28/paragon-is-not-collaborating-with-italian-authorities-probing-spyware-attacks-report-says/

• View post

  NEW: Hackers have taken down the infrastructure of the Linux-based operating system Ubuntu, and some of its websites. We verified that updates fail, and developers said the outage is affecting some APIs too. A group of hacktivists claimed responsibility, saying they used a DDoS-for-hire service. https://techcrunch.com/2026/05/01/ubuntu-services-hit-by-outages-after-ddos-attack/

• View post

  NEW: Researchers have have exposed yet another spyware maker that makes fake Android apps for its government customers. The apps were pushed with help of telecom providers. And it's yet another Italian company: IPS. Until now, IPS was only known to make traditional wiretapping surveillance systems. The researchers tied the spyware to IPS thanks to an IP address used in its infrastructure that was registered to “IPS Intelligence Public Security.” http://techcrunch.com/2026/04/24/another-...