Zach Edwards

just use TOR Browser if looking for that level of obfuscation imo 🖖

This is a really interesting development and if FF is able to grow market share with this feature, it could encourage other browsers to try and find a way to make theirs free too.

All that being said, FF really struggles with *making money* so it does still worry me when they start handing $$ out.

Brave browser also doesn't have a free VPN, in-fact I don't know of any credible* browsers with free VPNs built in currently. Even Apple's iCloud Private Relay costs money.

*Opera Browser has a free VPN but the browser is owned by a Chinese consortium and I wouldn't trust it at all.

Firefox Is Testing a Free, Built-In “Browser-Only” VPN Mozilla is testing a free, built-in VPN in Firefox to improve online privacy. The browser-only VPN hides your IP and encrypts traffic while you browse.

The new *free* FireFox VPN which has been tested for months (windowsreport.com/firefox-is-t...) is likely on the horizon for a wider release based on recent comments that a VP / head of Product at Firefox made on Linkedin.

Google couldn't even get a free VPN + abandoned their $$ "Google One VPN"

SS7 is gonna remain a dumpster fire security threat and China will continue to exploit it if we can’t even have simple cybersecurity requirements for the telecom industry.

GMAIL screenshot with the email subject line "Re: Issue 159469672: other in ~59 Chrome extensions in orchestration file, associated with malware group" with the detail Changed status: In Progress (Accepted) → Fixed

a 5+ year old bug ticket was finally closed by Google - this was actually the last significant investigation into Chrome extensions that I did because the feedback loop was so challenging

definitely still a place with research opportunities and threat actors regularly doing weird stuff! 🖖

Meta is earning a fortune on a deluge of fraudulent ads, documents show Meta projected 10% of its 2024 revenue would come from ads for scams and banned goods, and it internally estimates that its platforms show users 15 billion scam ads a day, company documents show.

Everything about this piece from Reuters about the scam ads on Facebook is wild -- internal Meta estimates noted they were showing these scams 15 billion times per day, scammers are not banned just forced to pay more for ads, teams internally restricted, must read: www.reuters.com/investigatio...

Large crowd of people at the No Kings rally in Houston, includes signs and flags and a blue and red and white umbrella and several inflatable frogs

fun to see my mom in this crowd shot from the No Kings rally in Houston featured by the Houston Chronicle @ www.houstonchronicle.com/projects/202...

Has anyone ever successfully received data from a personal Yandex data access request? Essentially receiving what data they collect on you as required under a bunch of privacy laws?

appreciate the link!

fwiw it was formerly owned by Elizabeth Wurtzel

It's possible but really no clue - got it at an estate sale from another author

Picture of a light blue book cover with a drawing of Abraham Lincoln and the text “Abraham Lincoln A Play By John Drinkwater”

A book page with a large black box glued to it with a white border in the box - the text says “ExLibris Alden Nash” and there is a strange symbol in the middle which appears to be the personal emblem of this Nash individual. The symbol has a double cross on top of a circle with a N in part of the circle. The circle is split by a horizontal line and part of the vertical line of the cross above.

I’ve got this 100+ year old copy of an old play about Abraham Lincoln’s life which was owned by someone named Alden Nash who had an interesting personal emblem that he screen printed & glued onto the cover page.

The play was shown at the Birmingham Repertory Theatre then the Hammersmith Playhouse.📚

cheers thanks very much!! 🖖

Mind map of SocGholish (Operated by TA56) infection chains. The details are complex but explained in more detail on our blog post.

Our team @silentpush just dropped a definitive look at SocGholish (operated by TA569) and the initial access broker ecosystem they are facilitating. Big thanks to past researchers who have worked on SocGholish! We've got details about our visibility @ www.silentpush.com/blog/socghol... 🖖🏻

Congrats! Very well deserved. 🖖🏻

Our team looks forward to providing updates on the FUNNULL CDN and the owner over the coming weeks and months. This network isn’t done and much stronger efforts need to be taken in the U.S. by a wide range of companies to deal w/ this ongoing persistent threat out of China. 🖖

I’ve got my own personal non-lawyer opinions (seems quite risky to host accounts for the owner of the largest CDN hosting scams targeting Americans), but I gotta assume that this is complex and there is currently a grey area that the U.S. Treasury needs to clarify.

It seems clear that serious enterprise lawyers from major tech companies may not agree on what U.S. Treasury sanctions require them to do when an individual is sanctioned who has accounts on their service.

Our research confirmed Lizhi still has active accounts on services including:
Twitter
GitHub
LinkedIn
Facebook
Google Code / Google Groups
Medium
PayPal
WordPress
HuggingFace
Gravatar / WordPress
Vercel
Deviant Art / Wix
Flickr / SmugMug
About Me / Vendasta
Tawk[.]to

Krebs put it nicely in his piece, “However, as Mr. Lizhi’s case makes clear, just because someone is sanctioned doesn’t necessarily mean big tech companies are going to suspend their online accounts.”

Do U.S. Treasury sanctions really have no teeth to require companies to ban accounts?

In this publishing process, we learned that different enterprise companies currently have different interpretations of what U.S. Treasury Sanctions / SDN processes require.

FUNNULL hosted websites have caused over $200 million in losses to U.S. victims, with an average loss of $150,000 per individual.

And yet the FUNNULL admin, who was also directly sanctioned, still has dozens of accounts on various Western enterprise services. So what gives?

FUNNULL CDN and the admin Liu Lizhi (aka Steve / Steven Lizihi) were both sanctioned by the U.S. Treasury in May 2025 – and in the announcement it was noted that “Funnull is linked to the majority of virtual currency investment scam websites reported to the FBI.”

Big Tech’s Mixed Response to U.S. Treasury Sanctions In May 2025, the U.S. government sanctioned a Chinese national for operating a cloud provider linked to the majority of virtual currency investment scam websites reported to the FBI. But more than a m...

Read @briankrebs.infosec.exchange.ap.brid.gy report @ "Big Tech’s Mixed Response to U.S. Treasury Sanctions" @ krebsonsecurity.com/2025/07/big-...

We found tons of interesting details including some anti-American and anti-Japanese statements on his personal blog.

Brian Krebs was also able to cover the research and helped to engage the enterprise organizations who are still hosting his accounts.

Numerous Western Companies May Still Need to Ban FUNNULL Admin Accounts to Comply with U.S. Treasury Sanctions Numerous western companies may still need to ban FUNNULL Admin accounts to comply with U.S. Treasury Sanctions.

Our SP piece can be viewed @ "Numerous Western Companies May Still Need to Ban FUNNULL Admin Accounts to Comply with U.S. Treasury Sanctions" @ www.silentpush.com/blog/funnull...

If I’ve been quiet you know I’m cooking up some fire research!

Our team at @silentpush.bsky.social is out today with a big report about the admin / owner of the FUNNULL CDN – essentially a dox of all his accounts and activities on the internet for the last 15+ years.

"Funnull had direct exposure to Huione Pay, for which the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) recently issued a finding and notice of proposed rulemaking (NPRM) identifying it as a primary money laundering concern" 👀

More on Funnull in this Silent Push report from January: www.silentpush.com/blog/infrast...

These are also Funnull IPs and domains: bsky.app/profile/camp...