I recently published a security research post on the myAudi connected vehicle platform. I found that anyone with a VIN can access a sensitive informations about car and ownership
I think the topic is useful beyond Audi itself, because many vendors now rely on these “connected vehicle” platforms and mobile apps, often with very similar architectures and assumptions
Across all major ShinyHunters campaigns (AT&T/Snowflake, Salesforce, Canvas/Instructure), only one event has both a publicly stated payment amount and a known approximate settlement date: the May 2024 AT&T payment of ~5.7 BTC (~$370K), confirmed by Wired but never published with a transaction hash. I use that as the analytical anchor for an end-to-end on-chain analysis using only free public data.
Pipeline (5 stages):
Result:
A single highest-fit candidate: 5.71997804 BTC paid 2024-05-17 22:04 UTC to a fresh recipient, spent in 6 min, laundered through a 6-cycle automated peel chain, terminating at an exchange deposit cluster. Funding side shows broker-aggregation fingerprint (4× 1.147 BTC peels in a 90-min window pre-payout). Upstream hub addresses appear reused across multiple victims of the same laundering service, active through 2025. Paper closes with the legal pathway from chain endpoint to indictment and a scoped compliance-request template.
Limitations (explicit in §5):
Ranking under a scoring scheme, not positive ID. No off-chain ground truth. Documented OKLink vs. Arkham label conflict on the dominant terminal, resolved via behavioural audit. No formal null-distribution analysis yet. Score weights are author judgements.
Asking for:
arXiv cs.CR endorsement — endorsement code: ZQXBSQ
github.com/tr4m0ryp/shinyhunters-gotta-catch-em-all/blob/main/Gotta_Catch_Em_All_ShinyHunters.pdf
Tooling and dataset released for reuse
The traditional vulnerability disclosure timeline relies on a fundamental assumption: exploit development and vulnerability discovery take time. Over the last 12 months the integration of LLMs into offensive tooling has demonstrably broken this assumption.
I recently published a technical write-up arguing that the 90-day disclosure window is effectively dead backed by three specific observations from recent incidents:
The defense cannot operate on monthly cycles when the offense is operating in hours. The focus needs to shift to real-time, PR-level AI scanning to match the pace.
can read the full technical breakdown and case studies on my blog:https://blog.himanshuanand.com/2026/05/the-90-day-disclosure-policy-is-dead/
I am curious if the researchers here are experiencing similar convergence rates or if you view this as a temporary anomaly while legacy codebases are scanned with new tools.
I built a realistic enterprise security architecture guide covering SPOFs, insider threats, and budget implementation
I recently investigated an individual operating through Odysee and Telegram who is selling a malicious Android RAT known as EagleSpy V6.0, which appears to be a rebranded version of CraxsRAT.
During the investigation:
\- I was financially scammed after payment
\- The seller blocked communication afterward
\- The malware infrastructure was analyzed in detail
Technical analysis confirmed:
\- Banking phishing overlays
\- Crypto wallet credential theft
\- Telegram bot exfiltration
\- Remote shell execution
\- Keylogging
\- Camera/microphone access
\- GPS tracking
\- Ransomware components
\- DEX packers for AV evasion
\- Hidden update/backdoor mechanisms
The repository also contained evidence of real victim infrastructure and compromised device information.
The malware appears capable of targeting not only victims, but potentially even buyers/operators through embedded update systems and hidden control mechanisms.
Relevant reports have already been submitted to platform abuse teams.
Odysee channel involved:
https://odysee.com/@justicerat:e
Telegram:
@JustIcedevs
This post is intended purely as a cybersecurity awareness warning to help prevent additional victims.
If moderators require technical validation or indicators of compromise, I can provide structured analysis details privately.
Today, we welcome the 42nd government onboarded to Have I Been Pwned’s free gov service: Costa Rica.
The CSIRT of the Government of Costa Rica now has access to monitor government domains against the data in HIBP. This enables their national cybersecurity incident response team to identify exposure of government email addresses in data breach, support prevention and analysis activities, and respond more quickly when new incidents appear.
Costa Rica’s CSIRT plays a national role in cybersecurity incident response, helping coordinate, analyse, and respond to threats affecting the government and the broader digital ecosystem. We’re very happy to support that mission by providing visibility into breached government accounts and helping them proactively reduce risk across public sector services.
Well, it's the day before the Instructure "pay or leak" deadline (at least by my Aussie watch), and the company remains removed from the ShinyHunters website. In its place sits a press statement that amounts to "we're not making any statements". So did they pay? And if so, what lofty figure would an incident of this scale command? The lawsuits are already being prepared (search for "instructure class action lawsuit"), so perhaps that will be the catalyst for transparency. What a crazy time.
This is a major release.
Feature highlights✨:
Logincli/purge.php to apply purge policy from command lineBug fixes highlights 🐛:
Security highlights 🛡:
UI highlights 🖼:
Extensions highlights 🧩:
This release has been made by @Alkarex, @Inverle, @Kiblyn11, @math-GH, @rupakbajgain, @xtmd and newcomers @polybjorn, @olivluca, @tomasodehnal, @PeterVavercak, @mrtnrdl, @ale-rt, @cweiske, @rid3r45, @gabbihive, @drosell271, @Kachelkaiser, @zanivann, @nanos, @bowencool, @pe1uca, @matheusroberson, @DenuxPlays, @rlrs, @chanse-syres, @IEEE-754, @umaidshahid, @michi-onl
Full changelog:
mdate:P1D for finding articles modified by the author / server during the past day.toString in case of regex-looking string #8479<iframe> referrer allow list #8672allowfullscreen to <iframe> #8467Set-Cookie using native PHP support of SameSite #8447, #8778
session.cookie-lifetime in php.ini<meta name="referrer" content="no-referrer" /> from deprecated never #8725.content pre code #8620Minz_HookType::ActionExecute #8599, #8603Minz_HookType as hook name in registerHook() #8600httpGet() #8700httpGet() cache nullable #8705select-input-changer JavaScript helper #8721get_icon_url() for feed favicon simplepie#974get_thumbnail() #8634, simplepie#970cli/purge.php to apply purge policy #8740timeago() #8670AGENTS.md, SKILLS.md, instructions.md #8478
