Nathan Patin

Threat actors are abusing the redirection-to-URL feature of legitimate OAuth services to redirect the targets of phishing campaigns to malicious downloads.

Attacks are ongoing and have targeted government and public-sector organizations.

www.microsoft.com/en-us/securi...

CBP Tapped Into the Online Advertising Ecosystem To Track Peoples’ Movements An internal DHS document obtained by 404 Media shows for the first time CBP used location data sourced from the online advertising industry to track phone locations. ICE has bought access to similar t...

New from 404 Media: CBP tapped into the online advertising ecosystem to track peoples' movements, according to an internal DHS document. Shows for the first time DHS tracked phones via process for putting ads in ordinary apps—video games, fitness apps, many more www.404media.co/cbp-tapped-i...

I built a free tool that shows how night-time lights have changed anywhere on Earth.

Here's how it works and why it's useful for monitoring conflict, disasters, development and growth. 👇

Iranian Hackers Use Elon Musk’s Starlink To Stay Online As the attacks continue, Iranians have turned to Space X’s satellite internet technology — including one of the country’s most notorious hacker crews, which is claiming retaliatory cyberattacks agains...

🚨NEW🚨 One of Iran's most notorious hacker crews, linked by Israelis to Tehran's intelligence apparatus, is using Elon Musk's Starlink to stay online.

It also has a blue tick account on Elon Musk's X, where it's been advertising its unverified retaliatory hacks.

www.forbes.com/sites/thomas...

Smoke rising over the Bandars Abbas Naval Harbour in Iran on March 2.

Fires at the Jebel Ali Port on March 1.

Planet has just released new high-res images from the Middle East conflict.

Left: Smoke rising over the Bandars Abbas Naval Harbour in Iran on March 2.

Right: Fires at the Jebel Ali Port in Dubai, UAE on March 1.

(Credit: Planet Labs PBC)

DHS's Office of Industry Partnership was hacked by a group called "Department of Peace" and info about ICE contracts with over 6,000 companies is now published on @ddosecrets.org!

Enjoy 🧊🔨 ddosecrets.org/article/ice-...

The Government Just Made it Harder to See What Spy Tech it Buys On Wednesday, the government stopped supporting FPDS.gov, an indispensable resource for finding what ICE, the FBI, and every other agency is buying. Its replacement site completely sucks.

New: the government just made it harder to see what spy tech it buys. This includes ICE, the FBI, essentially any agency. Why? Because they decided to retire the perfectly good system for searching contracts and replaced it with one that fucking sucks

www.404media.co/the-governme...

Last May, Tennessee Highway Patrol joined ICE on the streets of Nashville.

We @lighthousereports.com + partners mapped the traffic stops and used 1M+ ICE records, dashcam video, and court files to show how supposed routine encounters became deportations.

FBI Got Grok to Hand Over Prompts Used to Create Nonconsensual Porn The FBI obtained prompts used to make more than 200 sexual videos of a woman in a harassment case.

New: the FBI got Grok to hand over the prompts a suspect used to generate nonconsensual porn. Connected to a harassment case. Pretty rare to see a Grok search warrant like this

www.404media.co/fbi-subpoena...

Want to investigate something using open sources but not sure where to start? 🧵
We’ve gathered some of our go-to resources for learning, practicing, and collaborating on open source research - whether you’re brand new or sharpening your skills...

New —> OpenAI uses the ChatGPT logs of a Chinese law enforcement official to trace a sprawling covert influence operation aimed at intimidating Chinese dissidents worldwide & denigrating the Japanese prime minister: www.cnn.com/2026/02/25/p...

This App Warns You if Someone Is Wearing Smart Glasses Nearby The creator of Nearby Glasses made the app after reading 404 Media's coverage of how people are using Meta's Ray-Bans smartglasses to film people without their knowledge or consent. “I consider it to ...

New: this app warns you if someone is wearing smart glasses nearby.

Meta plans to add facial recognition to its Ray-Ban smart glasses. A 404 Media reader made this app after we showed men filming people w/o their consent, and DHS officials were wearing the glasses www.404media.co/this-app-war...

Reporter's Notebook: How to Investigate Shadow Fleets Tracing a ship's flag is often the first step toward uncovering bigger stories of corruption, smuggling, or sanctions evasion.

Tracing a ship's flag is often the first step toward uncovering bigger stories of corruption, smuggling, or sanctions evasion.

www.occrp.org/en/feature/p...

Today in Have LLMs finally mastered geolocation (cc @foeke.bsky.social)

Exclusive: US intelligence agencies tie Chinese explosive test to push for a completely new nuclear arsenal | CNN Politics US intelligence agencies believe that China is developing a new generation of nuclear weapons and has conducted at least one covert explosive test in recent years as part of a broader push to complete...

From my colleagues: A covert Chinese nuclear test is part of a push by Beijing to develop the world’s most advanced nuclear arsenal, US spy agencies believe www.cnn.com/2026/02/21/p...

“weak credentials with single-factor authentication” — credential stuffing but AI

Killing Anna - CPH:DOX A Syrian woman creates a fake identity on Facebook to trap war criminals in a gripping psychological thriller sparked by a shocking video.

Bellingcat's latest documentary, Killing Anna, a tale of catfishing Syrian war criminals and exposing their roles in a massacre, will be shown at CPH:DOX in March. The ultimate Doxxing at DOX.
cphdox.dk/film/killing...

For those who don't understand the "banality of evil" reference, it's from Hannah Arendt's book about Adolf Eichmann's trial in Israel. She used it to describe how ordinary Germans/Poles/Ukrainians became accomplices to the Nazis by mindlessly buying into the demonization of their Jewish neighbors

The blogger previously — 2.5 years ago! — wrote a post about archive.today but did not uncover any new names/aliases. Super weird!

Love a good metadata fail

1) create a threat model

2) use Signal (w/ disappearing messages + username)

3) use Proton in lieu of Google for docs, spreadsheets

4) meet in person if that makes sense

5) “my God, go out there and help people. Because we need it.”

How to Organize Safely in the Age of Surveillance From threat modeling to encrypted collaboration apps, we’ve collected experts’ tips and tools for safely and effectively building a group—even while being targeted and tracked by the powerful.

I don’t think I’ve ever had so many people writing to me to ask about encrypted/secure/private tools for comms, collaboration, and organizing. So @lhn.bsky.social and I talked to experts and assembled this: the Wired guide to organizing in an age of surveillance. www.wired.com/story/how-to...

"Racists ain't safe 'round this holler" t shirt sold by Screwston Antifascist Committee

"Bodily autonomy for all by any means necessary" t shirt sold by Screwston Antifascist Committee

"Racists ain't safe in the dirty south" t shirt sold by Screwston Antifascist Committee

Texas Attorney General Ken Paxton is targeting Screwston Antifascist Committee, calling them "deranged traitors".

They've got some pretty cool shirts for sale on their website
screwstonafc.shop

Introducing Markdown for Agents Cloudflare's network supports real-time content conversion to markdown at the source.

This is a really nice new Cloudflare feature: on-the-fly markdown conversion. Tools like Claude Code send an "Accept: text/markdown" header when making web requests. If you enable this it, it will send these agents a markdown version of your page instead of the full HTML. Really good for docs.

Free Tool Says it Can Bypass Discord's Age Verification Check With a 3D Model The tool presents users with a 3D model they can then manipulate to, the creator says, bypass Discord's age verification system.

The tool presents users with a 3D model they can then manipulate to, the creator says, bypass Discord's age verification system.

Epic OPSEC fail by Paragon exposing Graphite spyware capabilities.

Annotated pic from what we know.

Please help me figure out the other apps in in this pic that the spyware can access:

#WhatsApp
#Telegram
#Signal
?
#Line?
?
#Snapchat?
#TikTok?

1/

Government Loses Hard Drives It Was Supposed to Put ICE Detention Center Footage On A Kafkaesque saga in which the government has failed to produce critical video footage has reached new levels of absurdity.

In the latest episode of 'what happened to that CCTV footage from within an ICE detention center', the government now says it lost hard drives it was supposed to put the footage on

www.404media.co/government-l...

Google sent personal and financial information of student journalist to ICE | TechCrunch The tech giant handed over the personal information of a journalist and student who attended a pro-Palestinian protest in 2024. This is the latest example of ICE using its controversial subpoena power...

New, by @lorenzofb.bsky.social: Google sent personal and financial data about a student and journalist, who attended a pro-Palestine protest in 2024, to ICE agents in response to an "administrative subpoena," which had not been approved by a judge.

no eres mis casa bonita
no eres mis esposa bonita

Watch 404 Media’s Super Bowl Ad WE BOUGHT A SUPER BOWL AD.

404 Media just had an ad during the #SuperBowl! We Googled "smallest TV markets in the United States" and bought an ad for $2,550 that only ran in Ottumwa, Iowa, population 25,000. That still counts

www.404media.co/watch-404-me...