In this blog post, we'll examine the virtualization obfuscation used by Nike
nullpt.rs • Reverse Engineering Tiktok's VM Obfuscation (Part 1)
TikTok has a reputation for its aggressive data collection. The platform has implemented various methods to make it difficult for reverse-engineers to understand exactly what data is being collected and how it is being used.
Download pumping: New npm deception technique for supply chain attacks
Learn how attackers exploit automated bot traffic as part of software supply chain attacks to artificially inflate download counters and mask malicious payloads as legitimate.
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world.
Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild
Uncover real-world indirect prompt injection attacks and learn how adversaries weaponize hidden web content to exploit LLMs for high-impact fraud.
Katika Kühnreich (@Katika@chaos.social)
Attached: 1 image #SocialMedia of #realnameregistration , oh sorry, they call it real #humans , that advertises with " #AI " #slop #wsocial is more than problematic And already has #bots crawling it's #network Now they show that they are problematic concerning #aesthetics as well & advertise with tasteless #aislop @bildoperationen@tldr.nettime.org #realnameregistration is highly dangerous & if the company that wants to have your most private data can't save there net from bots they're not very trustworthy, are they? #tech
Mapping the online manipulation economy
A market perspective on digital manipulation may help improve online trust and safety , The internet is awash with inauthentic activity. Although some of this activity is harmless, a substantial proportion can be classified as malicious, including bots designed to steal personal data, networks of inauthentic social media accounts promoting crypto scams, and coordinated political influence operations ( 1 , 2 ). To enhance security, online platforms have implemented measures to counter inauthentic activity, with most requiring users to confirm account authenticity via a one-time password sent through short message service (SMS). However, there exists a thriving market for buying and selling on-demand SMS verifications, which forms a cornerstone of the wider online manipulation economy. Despite its centrality in the digital manipulation ecosystem, this SMS verifications market has not been systematically studied. To address this knowledge gap, we developed the Cambridge Online Trust and Safety Index (COTSI; cotsi.org), which tracks the daily price of SMS verifications for 197 countries and >500 platforms.
Mapping the online manipulation economy
A market perspective on digital manipulation may help improve online trust and safety , The internet is awash with inauthentic activity. Although some of this activity is harmless, a substantial proportion can be classified as malicious, including bots designed to steal personal data, networks of inauthentic social media accounts promoting crypto scams, and coordinated political influence operations ( 1 , 2 ). To enhance security, online platforms have implemented measures to counter inauthentic activity, with most requiring users to confirm account authenticity via a one-time password sent through short message service (SMS). However, there exists a thriving market for buying and selling on-demand SMS verifications, which forms a cornerstone of the wider online manipulation economy. Despite its centrality in the digital manipulation ecosystem, this SMS verifications market has not been systematically studied. To address this knowledge gap, we developed the Cambridge Online Trust and Safety Index (COTSI; cotsi.org), which tracks the daily price of SMS verifications for 197 countries and >500 platforms.
Thomas Larsen on Twitter / X
We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including… https://t.co/IxqLAto2XA pic.twitter.com/48BW4lmg76— Thomas Larsen (@thlarsen) September 11, 2026
Join the Sneaker Development Discord Server!
The largest community about antibots, web-automation and webscraping in the world! | 19643 members
An update on the scraper situation
Our article 'Fighting the AI scraper bot scourge', published in early 2025, discussed the probl [...]
nullpt.rs • Why Is This Fingerprinting Script Creating Bioweapons?
I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
Politicians are being sold AI-powered 'digital fighters'
A new app gets around bot bans by recruiting real people to post political messages generated by AI.
Botwatch
Fight bots by warning others. Support humans with verification. Build communities with trust.
Pwning Agentic AI Part I: Your AI Agent Is Already Compromised | TrendAI (US)
Organizations are rapidly connecting AI agents to their databases, document pipelines, and internal tools, creating privileged components that read untrusted input as part of their job. TrendAI™ Research examines how attackers turn these agents against you through return-to-tool (RTT) exploits, and what this means for the future of agentic AI security.
Security Verification
Security verification page to protect against malicious bots.