Javvad Malik

They found spyware that nobody had ever seen before. Then they realised they'd actually seen it years ago, just didn't know what they were looking at.

@billmarczak@medium.com

The Floppy Disc Generation’s Data Problem

I keep a box of cables in the garage. Not even sure why anymore. VGA cables, SCSI terminators, a couple of those old parallel printer cables thick as garden hoses. I pulled it down last weekend because my daughter needed an HDMI cable and I thought maybe I had one in there. I didn't. What I found instead was a box of old VHS tapes.

https://javvadmalik.com/2026/07/28/the-floppy-disc-generations-data-problem/

A hacker who demolished spyware makers, funded resistance movements, and vanished without trace. A decade later, still free. Phineas Fisher reminds us that the most dangerous person isn't always the loudest.

https://techcrunch.com/2026/07/25/the-hacker-who-humiliated-spyware-makers-and-was-never-caught/

Dolphin X apparently uses AI to prioritise high-value victims automatically... oh dear me.

https://www.bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targets/

Activists are getting spear-phished with stunning precision. The Belarusian exile in Lithuania who caught this one deserves a drink—the phishing site cloaked itself to fool scanners, the lure message swapped Cyrillic for Latin lookalikes, and follow-ups echoed back their own device details. Elegant work. Genuinely nasty.

https://resident.ngo/lab/writeups/check-and-protect-analysis-of-telegram-phishing-operation-targeting-exiled-activist/

Man tried to use a duress password at the border. Now he's being prosecuted for destroying his own phone. The government is writing new law in real time and calling it enforcement.

https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/