U.S. and Canadian authorities arrested and charged a Canadian man with operating the KimWolf distributed denial-of-service (DDoS) botnet, which infected nearly two million devices worldwide.
23-year-old Jacob Butler (also known online as “Dort”) was arrested by Canadian authorities in Ottawa on Wednesday pursuant to an extradition warrant.
According to a criminal complaint unsealed on Thursday in the District of Alaska, Butler was taken into custody based on IP address and online account information, transaction records, and online messaging records that exposed his links to the KimWolf botnet.
Butler now awaits extradition to the U.S. and is facing one count of aiding and abetting computer intrusions, which carries a maximum sentence of 10 years in prison.
As detailed in court documents, KimWolf operated as a DDoS-for-hire service and was used by cybercriminals to launch attacks reaching nearly 30 terabits per second, the largest DDoS attack publicly disclosed at the time.
Using a cybercrime-as-a-service model, Butler sold access to a massive network of compromised enslaved systems (ranging from digital photo frames and web cameras to Android-based TV boxes and streaming devices).
The botnet was used in more than 25,000 attacks targeting computers and servers worldwide (including Department of Defense Information Network IP addresses) and caused financial losses exceeding $1 million for some victims.
Researchers at cybersecurity firm Synthient, who have been tracking KimWolf’s rapid expansion, noted in January that KimWolf grew to almost 2 million after compromising Android devices in attacks exploiting vulnerabilities in residential proxy networks, and that it generated approximately 12 million unique IP addresses each week.
Separately, the Central District of California unsealed seizure warrants targeting 45 DDoS-for-hire platforms, which disrupted multiple DDoS platforms, including at least one that collaborated with the KimWolf botnet.
“These seizures broadly disrupted the DDoS platforms, including at least one that collaborated with Butler’s KimWolf botnet,” the Justice Department said yesterday.
“U.S. authorities also seized domain records associated with many of these services, redirecting them to an authorized ‘splash page,’ which displays a warning to potential visitors that DDoS services are illegal.”
Butler’s arrest follows a March 2026 international operation in which U.S., German, and Canadian authorities seized command-and-control infrastructure used by KimWolf and three related botnets (Aisuru, JackSkid, and Mossad), which collectively infected over 3 million IoT devices.
As the U.S. Justice Department said at the time, the four botnets collectively infected more than 3 million IoT devices, including web cameras, digital video recorders, and Wi-Fi routers, many of them in the United States.
Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.
This guide covers the 6 surfaces you actually need to validate.
There is a category of production incident that engineering teams are not tracking yet — because it doesn’t fit any existing postmortem template.
The agent initiated an action. The action was technically correct given the agent’s context. The context was incomplete. The infrastructure cascaded. And, by the time the incident review happened, three teams were arguing about whether it was an agent failure or an infrastructure failure, because the frameworks for thinking about these two things have never been connected.
The scale of this exposure is no longer theoretical. Seventy-nine percent of organizations now have some form of AI agent in production, with 96% planning expansion. Gartner predicts 33% of enterprise software will include agentic AI by 2028, but separately warns that 40% of those projects will be canceled due to poor risk controls.
What neither statistic captures is the failure mode happening between those two numbers: Agents that are running, that are not canceled, and that are quietly generating infrastructure events no one has categorized as risk.
I’ve spent six years building infrastructure automation systems at enterprise scale, first at Cisco (leading AI-driven lifecycle platforms deployed across 20-plus global enterprise customers), then at Splunk (designing AI-assisted root cause analysis and observability workflows across thousands of enterprise environments).
During that time I also filed a patent on intent-based chaos engineering methodology. And across all of it, I kept watching organizations make the same structural mistake: Treating autonomous agents and chaos engineering as separate disciplines. They are not. They are the same discipline, and the gap between them is quietly generating the next wave of major production incidents.
To understand why this matters, you need to understand what’s actually broken in how enterprises govern chaos today, before you add agents to the picture.
Most mature engineering organizations have invested in chaos engineering programs. Game days, blast radius controls, SLO-gated experiments. When a human engineer initiates a chaos experiment, the sequence has a critical property: A human is making a judgment call about whether the system has capacity to absorb the perturbation right now. They check dashboards. They look at the error budget burn rate. They assess whether dependencies are stable. It’s imperfect and often intuitive, but there is at least a person in the loop asking the right question before anything runs.
When you introduce an autonomous remediation agent, one that can restart services, reroute traffic, scale resources, or modify configurations in response to detected anomalies, that question disappears. The agent sees an anomaly. The agent takes an action. The action is a chaos event. No SLO burn rate check. No blast radius calculation. No human judgment about whether right now is the right moment to introduce additional stress into a system that may already be under pressure from three other directions.
Here is the specific failure mode I have watched play out. A remediation agent detects elevated latency on a microservice and responds by restarting the service cluster; a reasonable action given its training data and its narrow view of the incident. What the agent doesn’t know: Three other services are in the middle of handling peak traffic. The shared connection pool is already at 87% utilization. A dependent database is running a background index rebuild. The restart triggers a thundering herd against the recovering service.
What started as a latency spike the agent was designed to fix becomes a cascade the agent was never designed to model. The blast radius of that agent action was not the service restart. It was everything downstream of the restart, in a system state the agent had no complete picture of.
Nobody’s chaos engineering program had tested for that specific combination. Nobody’s blast radius calculation had included the agent as an actor. Because we don’t think of agents as chaos injectors. We should.
According to the AI Incidents Database, reported AI-related incidents rose 21% from 2024 to 2025. That count almost certainly understates the actual exposure, because most organizations have no incident classification that captures an autonomous agent action as the initiating cause of a cascade. The incident gets logged as a service restart, a connection pool saturation, or a latency event. The agent is invisible in the postmortem.
The underlying problem is that enterprise systems have no shared language for absorb capacity — the real-time estimate of how much additional stress a system can take before it breaches its SLO commitments. Chaos engineering programs manage it implicitly, through human judgment and static thresholds that fire after a limit has already been crossed. Agents don’t manage it at all.
Through structured primary research with site reliability engineering (SRE) and platform engineering practitioners across organizations including Intuit and GPTZero, I’ve been developing a resilience budget model. The core idea is to treat absorb capacity as a continuously recomputed, consumable resource rather than a static threshold you try not to breach.
A resilience budget draws on four live signal classes.
SLO burn rate is the primary input, because it directly encodes the distance between current system behavior and the commitment that actually matters. If a system is burning its monthly error budget at five times the expected rate, the resilience budget is near zero regardless of what CPU utilization looks like.
P99 latency trend matters more than absolute latency, because a service trending upward over forty minutes tells you something different than a service that has been stable at the same absolute value.
Dependency saturation state is the most commonly missed signal; a chaos experiment or an agent action that assumes a shared connection pool is freely available when it’s sitting at 87% will produce failure modes that nobody designed for.
Application behavioral signals, session completion rates, API call pattern shifts, conversion degradation, and surface system stress earlier than infrastructure metrics do, because users feel the degradation before Prometheus reports it.
What makes this a budget rather than a threshold is that it is consumable. Every chaos experiment draws from the available capacity. Every agent action draws from it. In multi-team organizations where multiple experiments and multiple agents may be acting simultaneously, the budget is shared.
Without a shared ledger of consumption, two teams running experiments against overlapping dependencies produce a combined blast radius that neither team planned. Add autonomous agents acting completely outside the ledger, and the accounting collapses.
Several engineering organizations are now running experiments using large language models (LLMs) to generate chaos hypotheses from dependency graphs and incident postmortem corpora. The results are directionally useful. Language models surface plausible failure modes that experienced SREs recognize as worth testing, and they generate hypotheses faster than manual processes, particularly when working from rich postmortem history.
The limit is dependency graph staleness, and it is a hard limit. A hypothesis generated from a graph that doesn’t reflect last month’s service extraction, or a new shared library dependency added two sprints ago, will propose an experiment with incorrect blast radius assumptions. The problem is not that the model makes a mistake, it’s that the model doesn’t know it’s making one. It will be confidently incorrect about a system boundary that no longer exists, and in chaos engineering, confident incorrectness in production means an unplanned outage.
Stanford’s Trustworthy AI Research Lab found that model-level guardrails alone are insufficient: Fine-tuning attacks bypassed leading models in the majority of tested cases. The implication for chaos hypothesis generation is direct, a model that cannot reliably hold its own safety boundaries cannot be trusted to accurately model the blast radius of an action it has never seen in a dependency graph it has not verified.
When hypothesis generation draws instead from postmortem corpora, the staleness problem shrinks considerably. Postmortems describe failures that actually occurred in the system at a specific moment in time. The signal is inherently validated by production reality. This is the tractable near-term AI application in this space, and it is genuinely useful for organizations with mature incident documentation practices.
What AI cannot do, and should not be asked to do, is make the execution decision when signals are ambiguous. That judgment requires awareness of things that live entirely outside any monitoring system: Pending deployments that changed the dependency landscape an hour ago, on-call staffing levels on a holiday weekend, a customer commitment that makes any additional risk unacceptable until Monday.
A model without access to that context should not be making that call. This is not a temporary limitation pending a more capable model. It is a structural constraint of what machine observability can represent, and building an agent architecture that ignores it is building one that will eventually make a consequential decision with incomplete information — and no human in the loop to catch it.
The governance implication is straightforward to describe and harder to implement than it sounds. Every autonomous agent action that touches infrastructure needs to register against the same live signal layer that governs chaos experiments. The same SLO burn rates, latency trends, dependency saturation states that a human engineer would check before initiating an experiment should gate what an agent is permitted to do and when. If the resilience budget is below a defined floor, the agent waits or escalates. It does not act.
Agent actions also need to be modeled as experiments, not just logged as events. When an agent restarts a service, the question isn’t only whether the restart completed successfully. It’s whether the blast radius of that action was proportionate to the available absorb capacity, and what cascading effects it produced across dependencies. That is chaos engineering data. It belongs in the budget model, feeding the next decision the agent or the team needs to make.
And when signals are genuinely ambiguous, when the budget score is unclear, when a recent deployment has changed the topology in ways the agent’s context window doesn’t capture, when dependency states are in flux, the execution decision needs to go to a human. Not as a permanent limitation on agent autonomy, but as a hard engineering requirement for the current state of the technology.
A circuit breaker that hands ambiguous cases to a human is not a weakness in the agent architecture. It is the thing that makes the architecture trustworthy enough to actually run in production. Intent-based verification formalizes exactly this: Defining what correct agent behavior looks like before deployment, then continuously probing whether those boundaries hold under live system conditions.
The organizations that operate autonomous agents reliably at scale are not the ones with the most sophisticated models. They are the ones that understood, before something went badly wrong, that every agent action is a chaos event and built their governance layer accordingly.
The practical first step is unglamorous: Audit every autonomous agent currently touching infrastructure, map its action surface against your live SLO burn rate signals, and define explicit floor conditions below which the agent is required to wait or escalate. That audit will surface agents acting entirely outside your resilience accounting.
Most organizations running agents at scale today have several. Find them before production does.
Sayali Patil has spent 6-plus years at Cisco Systems and Splunk building the reliability and automation systems that keep enterprise AI infrastructure running at scale.
Welcome to the VentureBeat community!
Our guest posting program is where technical experts share insights and provide neutral, non-vested deep dives on AI, data infrastructure, cybersecurity and other cutting-edge technologies shaping the future of enterprise.
Read more from our guest post program — and check out our guidelines if you’re interested in contributing an article of your own!
KETTLE Google I/O has ostensibly been an AI show for a few years running, but this year’s announcements have taken the cake, which Google seems all to happy to let its users eat as it reshapes the web.
On this week’s episode of The Kettle, host Brandon Vigliarolo is joined by El Reg senior reporter Tom Claburn and open source reporter Liam Proven to discuss how Google’s bevy of AI announcements, and declaration that we’re entering the era of AI search, might not play well with customers.
From an enlarged AI mode, to AI ads stuffed into AI answers, and pushing AI devs onto closed-source tools after shuttering open-source ones, Google is leaning hard into its version of the future of the internet no matter what users might think, and we wonder whether that might finally crack Google’s stranglehold on the web.
You can listen to The Kettle here, as well as on Spotify and Apple Music, or read the transcript of the latest episode below. It’s been lightly edited for clarity.
Brandon (00:04)
Welcome back to another episode of The Register‘s Kettle Podcast. I’m your host Brandon Vigliarolo, and you’ve likely heard about this week’s topic if you’ve paid any attention to the internet in the past week. Google said at its annual I/O event that it’s reinventing search for the AI era. But from an outsider perspective, it seems a lot more like Google’s leaning into AI as an excuse to reshape the web and Gemini’s image, regardless of how that might affect access to the open web. Unpredictably, there are a lot of people calling foul over that and other recent AI moves made by Google.
With me to discuss this is El Reg Senior Reporter Tom Claburn. And joining us for the first time on this iteration of the kettle is our open source guru Liam Proven. Thanks to both of you for being here.
Thomas Claburn (00:45)
Thanks.
Liam Proven (00:46)
Thank you.
Brandon (00:46)
So hey, Google’s AI-ification of search was the big news to come out of I/O this week. Tom, you tuned into the keynote and wrote about this. So what exactly did Google say it’s going to do and why is everyone so up in arms over this?
Thomas Claburn (01:01)
I mean, it’s just more encroachment of AI into search and they, you know, they have their AI Overviews, which are the little summaries that they put up on top of search results. And then they also have separate thing that’s very similarly named, but different called AI Mode, which is available through a tab and you click on it that’s sort of a deeper version of AI, I think it ties into some, Google knowledge graph and it has sort of a broader thing, but you often get similar results, but basically they’re going to be showing more of the AI Overviews and, it’s not always clear when these happen, but basically for longer queries, it’s more likely to be handed off to an AI model.
Brandon (01:44)
Mm-hmm.
Thomas Claburn (01:45)
And it’s a problem for a lot of people because people’s relationship with Google began with: you go to Google, you find stuff, and then you leave. And increasingly, it’s you go to Google and you’re stuck there like it’s a tar pit. And you’re just trying to figure out where did they get this information? And they’ll put up a summary. And of course, they have the disclaimer, well, you know, maybe it’s not accurate. You’ll have to check on that. How are you going to check on it? I’ll go to the links that we didn’t show you. It’s, you know, people I think are a little bit – I mean, part of it is just people don’t like change, but part of it is just AI really is not the right answer for a lot of things, at least in my opinion. I think there are certain kinds of queries that it can be useful for. And I think that largely though, if people are going to look for documents, they need to be able to find reputable sites and be able to make trust decisions. And a lot of that information is getting obscured or put into little teeny citation chips that you have to click on to figure out, where is this information coming from?
Brandon (02:49)
Yeah, and sometimes when you click on one site, it’ll give you four or five links and be like, well, here’s the sources we use to compile this information. Like a lot of times, I’ll admit, I do use the AI Overviews every once in a while when they pop up, especially for simple questions like on my smartphone or something. But they’ll give you, cite their sources and you click on them. But sometimes that’s just as big a pain in the butt as assuming that the AI Overview is just correct. I’d much rather just have a list of blue links, which Google did clarify to me and to Avram, our US editor, earlier this week, that traditional search engine result pages are not going away.
Thomas Claburn (03:24)
Yeah, they’re not going away. They’re just going to get buried under more AI. You have to work harder to find them. And then there was some other interesting stuff too, where their Gemini Spark, which is their agent… in the Gemini app, they’re also going to be pushing these long-running AI tasks that you’ll be able to do, and they’re eventually going hook it up to the regular Google account or search or whatever. So you can basically run a chron job with, you know, an AI model essentially, to go do things for you. And I think that the think they talk about it for is shopping. It’s gonna, of course, plan your travel itinerary and do stuff for you in the background, and somehow you’re gonna be happy with results. It’s not clear how you’re gonna pay for that because someone has to run this stuff, maybe this all comes out of the hide of advertisers who are gonna sort of get shoveled into these results, who knows?
Brandon (04:20)
Right, and that’s actually kind of segues really well into one of the stories that I wrote about I/O this week, and that was Google’s new AI advertisements that they’re kind of injecting in. They… I see we’re doing audio, but I see Liam on the other side of the camera just putting his hand in his hands, you know, my God. We talk about where the cash is going to come from from this, and it’s obviously going to come from this, right? There were two particular kinds of AI advertisements that Google said they were going to add soon to AI mode. There were some ads that were going to be basically in line. If you ask a query, you get your responses back from the AI. In that list of results is going to be ads. And Google said they’re going to be at the bottom of the list, but they’re still going to be presented in line. And I think there might be some indicator about them being a sponsored element of the post, but they’re still putting them in line with results that are ostensibly grabbed from the web and are supposed to be factual.
The other one that I found a little more concerning personally was conversational discovery ads. So basically the way Google described this is, you ask a complicated question and it will use Gemini to figure out what products you need to solve your problems. And the example they gave was, oh well, your house smells kind of musty and you want to make it smell more like a spa. Well, I feel like if I were to go onto Google right now and type in, my house smells musty and I don’t want it to.
Some of the first things you might get are things like, put some baking soda in some water, make a 50-50 mixture of vinegar and water, and you can deodorize and clean for pennies on the dollar. But Google sees this as a way to inject products in front of you…. I was picturing going in there and asking for tips on cleaning my house and deodorizing it and getting a whole bunch of ads for $20 reed diffusers, expensive plug-in units.
Liam Proven (05:55)
Mm-hmm.
Brandon (06:08)
That’s how I see this, right? And I don’t know if that’s entirely correct, but Google’s not doing a lot to kind of say that that’s not the case.
Liam Proven (06:17)
I feel like the great prophet Cory Doctorow kind of nailed this a couple of years ago now with this word, enshittification. I was baffled when Google announced that it was going to start deliberately degrading search results in the interest of keeping people on the page and on the site longer. And it feels like they’re not leaning in, they dived off the board and jumping in, pinch the nose and throw yourself in. I do not see how this is going to pay long term, but, on the one hand maybe there’s some genius there with playing playing four-dimensional chess, maybe they’re just… they’ve drunk the Kool-Aid and cannot imagine anything else now
Brandon (07:05)
Yeah, it just feels like an attempt. I mean, it was the same thing with Google saying that they were introducing, I think, some commerce protocols earlier this year that were designed to basically allow Gemini to check out for you. So you don’t even need to go to a company’s website to buy a product now. You can do it all right through Gemini. So that, again, that’s starving a company of web views so that Google can make a few more cents on a transaction.
Thomas Claburn (07:28)
Yeah.
Brandon (07:29)
And I don’t see how this is any different, right? It’s injecting more ads, getting more things in front of you, and burying actual web results below this in the hopes that you never get to that point.
Thomas Claburn (07:36)
And the one thing it’s going to incentivize is that everyone who actually wants to use an AI model is going to think, how can I use this to block ads? How can I use it to get this stuff out of my Google search results and get something that’s closer to whatever, some kind of neutral or less commercial standard? At least if you put up with it, if you don’t just turn it off entirely and think, I’m going to figure out – I’m going to go back to Yahoo and get a list of curated sites and just stay there.
Brandon (08:06)
I think about it sometimes in terms of, you know, well, Google Search was never giving me an objective view of what’s on the internet, right? It’s always filtered through Google’s algorithm or whoever’s. But I feel like there’s a difference between filtering it through an algorithm and making me do the legwork and just assuming that whatever Gemini is serving to me is going to be exactly what I need because Google thinks that’s what I need.
Liam Proven (08:31)
Maybe you take a, what’s the expression, a 30,000 foot view, but I think we’ve got to go a lot higher and take a low earth orbit view. This is going to be very good news for the wider software community as it drives improvements in ad blocking technology, Google-free browsers, Google-free search engines, Google-free anything, please, anything that can get this stuff out of our face.
Thomas Claburn (08:56)
Europe is already partway there with the sort digital sovereignty stuff. I mean, this is just another sort of data point in the rationale for moving. perhaps we’ll finally see some innovation where Google kills its own search business. And it’s not like search was doing so well anyway. Even before the AI boom, was a lot of complaints that there were just lacks about policing, spam farms and things like that. There was a lot of lifting you had to do even just as a 10 blue links user to sort through the junk. And if they really cared about delivering quality editorial to people, the web would look a lot different.
Brandon (09:35)
You just wrote an op-ed, Tom, that kind of covers some of that, right? You asked Google’s own AIs why Google search results were getting worse, and it pretty much was like, yeah, hey, they are. Mea culpa here, you know, it was…
Thomas Claburn (09:39)
Right. It’s unfair, but it’s also, kind of telling that this is what we’ve come to where, we’re going to source stuff off of a couple of Reddit opinions and blogs. And then, when you ask it, when you frame it in a nice way, “why is Google search great?” It goes to Google’s own blog posts to source that. I guess that works for some people, but it’s really just a poisonous media ecosystem. I who wants to even be a part of that? I mean, I think all of this just drives a lot of sane people away. And the only people who are left are gonna be sort of hucksters and grifters and people who are trying to game the system for whatever commercial intent they have.
Liam Proven (10:27)
It is. Yeah, it’s going to. think one possible effect will be driving the creation, the fragmentation of the Internet, maybe not exactly layering, which is what I thought might be happening a decade or so ago. But in the same way that there are sites like Conservapedia and so on that try to present a U.S. right wing Moral Majority type view of Wikipedia, that there will be a fragmentation into the AI-driven web and the little indie, we’re trying to keep this out, AI-free web. There already was this attempt the other Gemini, Gemini the protocol, it was launched about a decade or so ago now.
Brandon (11:19)
Yeah, really quick, remind us what that is?
Liam Proven (11:22)
It’s an extremely lightweight protocol and markup language for serving pages of hyperlinked content, that’s not the web. And you needed to run a Gemini server and you needed to use a Gemini browser to access it. And it gave you kind of like a markdown view of the web. So you got, bold, italic, and underline and nothing else … you have no color, you have no fonts, you have no images and really, really stripping back the online hypertext experience to like an early nineties view. It’s kind of faltered in recent years, but it’s people choosing this very minimalist and stripped-back experience and much as it seems, I think, to baffle marketing executives, I think a lot of people would choose an un-augmented AI-free view of the web these days.
Brandon (12:18)
I mean, just think about, good Lord, the videos coming out of college graduations recently, right? know, everyone, I think Liam, you mentioned earlier, everyone except Woz has been booed to hell and back in the past couple of weeks for making AI claims. I think there’s a lot of dissatisfaction with it, right? I think you’re right. I think there’ll be a lot of people.
Thomas Claburn (12:36)
The irony is that this should be the moment to shine for the social media networks that are notionally about people and connections, which haven’t been with Meta and Facebook. I mean, it’s turning into the same AI slop engine as everything else and is driving people away. There’s theoretically room for some kind of network that humans can interact with because it’s just not pleasant to be with bots. I mean, nobody wants to get AI communication. No one wants to deal with it. And you just cannot operate in the same space as a bot. They operate on a velocity that people can’t deal with. And it’s just frustrating. So I don’t know how people are going to want to participate in this.
Liam Proven (13:14)
I’ve gone through a little unexpected voyage in recent months because oddly enough, as a professional writer, and I also read a very great deal and have since childhood, I kept reading people saying, “this text is AI generated. I’m not going on any further because I read the first couple of lines and I just knew. It’s full of AI tells.”
And so I started asking people, you know, what are the tells? What are the signs? Oh it’s, it’s, it’s just obvious. It’s redolent. Okay. But can you give me a clue here? You know, what, what are the things that give it away for you? And I have not yet been able to get anybody when pressed to give me a nice clear list. You know, a lot of it boils down to em-dashes and I’ve been using them for years, but
Brandon (14:04)
I wasgonna say I love the dash, so it really kind of throws a wrench in my work.
Proven (14:06)
Right?
You know, I learned there are a handful of actual fairly concrete things, you know, the “not only, but also” kind of structure that the bots do overuse. But I’m seeing people going, “I’m not going to read that because it’s obviously bot-generated.” And then somebody else pops up and goes, “Hi, I wrote that. That’s my site. I don’t use any bots. That was all just me.”
One guy recently I was reading said, “Look, I’ve got the git history with the 19 commits, because it’s not a very long site, you know, as I wrote it. Would you like me to show you the process by which I wrote every word?”
And of course the guy challenged goes, “Well, I don’t know. I’m not sure I believe you.”
And he’s like, “Okay. So you’ve gone from a certainty to doubt. I guess I’ll take that.”
But I watched with interest the relaunch of the Digg social network over the last year or so. And Digg was very much like Reddit about 15 years ago, coming up to 20 years ago, it was a site with lots of special interest groups where you posted interesting stuff, but was driven by threaded conversation.
Brandon (15:12)
Yeah, I remember Digg. It was great. When it went under I just moved to Reddit.
Liam Proven (15:20)
And, and, the guy, I think it’s Kevin Rose that owned it, got it back and relaunched it very much in the old model, but without the ability to create your own groups and stuff. So he was trying to keep it a bit smaller.
And I joined, because I had a Digg account in the day and thought, this is strangely bland and anodyne. You know, it’s full of people being nice to each other and saying nice things. And it seems to be largely content-free. Well, it shut down again earlier this year. And he said, “We got infiltrated by bots. We got loads and loads of people posting bot-generated content until a lot of the discussions were bots talking to other bots.”
That would kind of explain what I saw, you know, but I’m still on Twitter, call it Twitter. I’m still on Twitter and I have a block list, which is like six pages long now of words and phrases. And it makes it kind of tolerable, but it is very odd to watch the interchange and they’ve changed it recently so that you can block accounts, block and mute accounts which are serving ads and yeah, if those are paying, paying advertisers, they ignore your blocks. You get them anyway. ⁓ all right. Yeah.
Brandon (16:30)
Yeah, of course. I have the same thing on Reddit, right? I’ve blocked multiple advertisers and I go in to see, well, why am I seeing this? I want to block this account again. It’s like, no, you already got this account blocked. And it’s like, well, then why am I seeing your ad?
Liam Proven (16:39)
Yeah, yeah.
And yet, you know, it’s still actually quite lively and there’s a lot of discussion and there are still interesting people and some of the interesting people I followed years ago still are still posting and the discussions are still good. Some people are choosing this experience and it’s not just because they’re paying for it. Some people will choose this experience for reasons that escape me.
Thomas Claburn (17:01)
People build up, you know, it’s the follower structure. You build up an audience and it’s costly to rebuild that. So a lot of people have stuck with X and there are now political reasons to stay with X and a lot of people have done that. And even journalists – I mean, I would have loved to given up my X account, but it’s useful because there are still people who post interesting things.
Brandon (17:28)
Yeah, I don’t really post on there anymore, but I still have my account.
Thomas Claburn (17:30)
Yeah, it’s worth it for sort of source finding. People, I think that they flee the AI influence when they see it. If they don’t leave the site, they figure out a way to filter it. So I think it’s going to be a very difficult few years as some kind of new equilibrium emerges because the old sort of systems where people and bots mix is just not satisfying to people.
Liam Proven (17:54)
And as X declines, I’m watching Mastodon, the Fediverse grow and get more interesting and get more feedback and interesting discussions. I still find Lemmy kind of a pain to deal with. I don’t really like the presentation, which is like the activity pub-driven version of Reddit, kind of, but I’m getting lots of interesting comments and feedback and, I don’t like this word, but engagement. People are engaging on Mastodon in a way they used to on Twitter and some of the other sites.
Brandon (18:26)
Fleeing before AI, and hopefully it won’t come to those platforms either. But back to some of the things that Google’s been doing, and I guess we can speak more to the alienation aspect here, Another story that I covered this week out of I/O was that Google – a lot of people probably are familiar with the Gemini command line interface, allows you to at least use Gemini to look at code and do some various programming tasks. And that’s an open source tool that Google’s had for, I think, about a year now. But in classic Google fashion, they’re deprecating it in favor of the new one that they announced at I/O this week, Antigravity CLI, which has, you know, some, I think, feature improvements over Gemini CLI, right? Gemini CLI is Gemini. Antigravity is, I think, a little more model-agnostic. But it’s closed source. And that means that basically anyone who was using Gemini CLI is going to not be able to use it come June 18th. It’s just going to stop working. Google’s not ending their maintenance of Gemini CLI. They’re just restricting it to high-tier enterprise customers. So it’s still there. It’s still an open-source product. You’ve just got to pay to use it now.
I found it interesting that a lot of developers, when I was reading some threads about this, were saying that they were particularly upset about the fact that they felt like they had spent their time and their effort to help improve Gemini CLI through bug reports and things on GitHub, right? And now all that work is essentially being closed-sourced in a new product and sold back to them. You know, I wonder again, right, is this Google kind of leaning into another AI product that’s just gonna piss more people off?
Thomas Claburn (20:00)
Right. Well, I mean, the first lesson is never, never bet on a Google product because they kill them off mercilessly. It’s also, the amount of damage that the AI has done to the open source community, we’re going to be dealing with it for years…I’ve had a couple of projects where I think like, do I even want to make this public because I’m just going to get, if anyone uses it, I’ll just get AI bug reports. And in a sense, all of open source has been captured in these models anyway. And you can just ask the model to regenerate all this unlawfully captured labor that is latent in these things. And we haven’t figured out a way to deal with that. I hope that some of the software lawsuits make progress because it’s really transparent that people’s labor has been captured in ways licenses did not condone or anticipate. People are just reselling that labor at increasingly high prices.
Brandon (21:00)
Yeah. Liam, you cover open source stuff a lot. What has the developer community been saying about AI and its influence.
Liam Proven (21:06)
Again, I think. Obviously this, has to be a super generalization, but it, seems to me that it’s, it’s splitting and factionating. And on one side, there’s a group of people who embrace the tools, say that it’s delivering unprecedented levels of productivity and so on. And on the other side, on the, the other faction, there’s a group of people saying, no, we will not allow this anywhere near any product that we use, run, develop. There are a handful of people who are kind of still in the middle like looking from side to side and I recently wrote about the new version of OpenBSD and it’s faced such a problem which is that OpenBSD incorporates tmux, a text mode terminal multiplexer. So you can have windows in your terminal and different stuff going on. And tmux started allowing Claude-assisted code contributions. And that means they got grandfathered into OpenBSD.
But the OpenBSD project has said we won’t allow AI-generated code because we can’t copyright it. We can’t put a firm license on it because we can’t say where it came from.
So on the one hand, we can’t allow you to contribute authored code. On the other hand, here’s an externally maintained project, which is using AI-authored code. So they’re kind of stuck in the middle.
The most interesting study I’ve seen on this where somebody tried to put numbers on it was from an organization called [METR ]. And they published the results of a study they did. They did a controlled trial with a whole bunch of developers given various programming tasks. And one half of the subjects were allowed to use AI tools and the other one not.
And at the end of it, they asked the developers, how was it for you? You know, was it helpful? And all the people using bots went, it’s great. We estimate it’s taken about 20% of the time off the process of developing this feature and getting it working. And then they compared it with the other developers who weren’t using any kind of code generation. And in fact, the people not using the tools were 20% quicker. In other words, it feels like you’re going faster, but actually you’re going slower, but you sit there and watch the code unfold on your screen. I don’t know. I’ve never used any of these tools. I’m an AI vegan. I avoid the whole thing, but you sit there and watch the bot write code and go, well, that was quick. All I’ve got to do is make sure it works. And four hours later it works, but you could have written it in three hours.
And the odd thing is I saw this report and I linked it and shared it and cited it. And then I bothered to go and look at who [METR] is. And [METR] is a pro AI advocacy group. They are AI boosters, but they decided let’s get some proof of how much quicker it makes you.
Well, we said we’re going to do it, so we’re going to publish. Respect to them for that. I do wonder if all of the AI assisted projects, the ones that are really leaning in, are going to come up with a nasty surprise. Either this didn’t really help and we got a load of stuff we can’t debug, or actually this is taking longer, or the price of this tool I’m using just went up, it just gained a zero and it’s going to go up again and damn it, I can’t afford to use this anymore.
Thomas Claburn (25:00)
Well, there was just a report recently that Microsoft canceled its internal cloud licenses because of the price hikes. I the price is going to go up and ⁓ the problems aren’t necessarily going to be evident right away.
Brandon (25:15)
I’ve heard multiple instances of companies basically saying, well, these AI products are doing fine, but at the end of the day, they’re more expensive than a new developer fresh out of college. So why would we use them? So it’s interesting.
So before we wrap up, I wanna touch really quick on something that you wrote too, Liam, it was a couple of weeks ago, but I think it still plays into this whole idea of Google’s. AI-ification thing. that Chrome was quietly installing large language models on users’ machines without expressive consent. So I understand you can flag that and turn it off. It’s an opt-out thing. But is that still happening? Did Google change tack on that after this was reported on at all?
Liam Proven (25:55)
As far as I know, no, I have not checked because I didn’t have it anyway. Every time any app offers me any kind of AI integration, I just turn it off as soon as I can. And I’m not even sure what boxes I ticked in Chrome and when, but when I found out about this, I went looking and no, not on my –I have my Google Chrome profile synced onto Windows and Linux and Macs, and it wasn’t there on any of them.
But on the one hand, I’m noticing in the open source world, some projects are belatedly embracing this, but they’re talking very much about local first, open source models. Let’s keep it on your machine, private. There’s no risk of any leaks. And actually that is kind of what Gemini Nano was supposed to do. It’s a tiny model, four gigabytes, a tiny model that wouldn’t fit into memory on an x8632 box, but hey, a nano model that ran on your machine so there was no risk that anything could leak. Well, that is actually a good thing, I guess.
Brandon (27:06)
Sure, yeah.
Liam Proven (27:10)
But it did it on phones as well. And now, okay, you know, I’m cheap. I use very low-end, mostly Chinese phones. But you know what? I live on a little island in the middle of the Irish Sea. I fly a lot more than I used to these days. And a couple of months ago, I was about to make a trip and I thought, I’ll put some new music on my phone. The only time I use my fancy noise-canceling headphones is on planes. Oh, my phone’s full. And this current one doesn’t have a card. I have to sync over a cable. So that’s weird. I haven’t got that much music on it. I discovered about a dozen or 20 feature films on my phone I have no recollection of ever downloading. I’ve never seen these films. I guess some search term somewhere synced something. I deleted them.
Brandon (27:58)
Better an MP4 than an AI model, I suppose, right?
Liam Proven (28:00)
Yeah, but at least it was something I could sit and watch on the plane. I deleted them all, fitted a bunch more albums on there and all was good. But yeah, even with my cheap-ass 300 buck phone, okay, four gig here or there is kind of nothing. But even so, I’d rather that space was for my stuff. If you’re going to take that much ask.
Brandon (28:23)
Yeah, local LLMs are good idea, but ask me first.
Thomas Claburn (28:27)
It also raises the issue of what’s the difference between that and a crypto miner if someone else is using it, external server is using it. I’m fine with providing storage for something that’s going to benefit me, but when some entity that I have a relationship with, or don’t, is running stuff locally using my storage capacity and my processor for their benefit, I don’t know about that.
Liam Proven (28:53)
Yeah, exactly.
It’s like one of those proof-of-stake cryptocurrencies rather than a proof-of-work one, you know.
OK, I said earlier I don’t use any AI tooling. There’s one exception for that, which is I do use language translation tools, and I use them quite a lot and I’ve got a choice of them. I spent nine years living in the Czech Republic, a country with a brutally hard language I still can’t read worth a damn. So if they said, like the deal with Firefox, we’re going to put a model in your browser, but it’ll translate stuff on your device and it won’t go to the cloud. Well, okay, that could actually be useful. It’s not quite at the point where I could use my phone to translate a menu while I’m offline on a plane or something, but you can see that is not far off. But you know what? I want to know why, I want to know what your what you’re extracting from me and what I get in return, and make my own choice. And increasingly that is a choice we’re just not getting.
I personally do not think that open source products like Ubuntu, like Fedora, including even optionally, open source models, which are privacy first and local and … No for me, that’s not good enough. I don’t want that. And I’m not really interested in any product that includes that. And I appreciate they’re trying to do the right thing, but I think they are going to be shocked by the level of hostility. Fedora is already backing down from its moves to attempt to become the best Linux for AI development because to their great surprise, there was a user outcry. I think Ubuntu cares rather less about what its community thinks. They just try and do what they think is best. But I think they’re going to be surprised by the pushback, as probably Google was.
Brandon (30:53)
Google obviously, they might be surprised by the pushback, but the question is, will they care? It seems like by and large, Google’s – I think it was 2018 when they formally abandoned the “Don’t Be Evil” slogan, I think, right? And it just feels like with these announcements lately that they’re really just making sure that it’s fully whited out and erased from memory here.
I mean, I don’t know, putting an AI wall between people and the open internet, secretly uploading LLMs to people’s machines, forcing people onto closed source products. I mean, any thoughts on what’s gonna happen here? Any thoughts, guys, before we wrap this up? Like, is Google gonna face blowback? Are they too big to fail?
Thomas Claburn (31:37)
Not for nothing is there all this excitement about someone finally being able to sort of take some of Google’s business. I the whole internet AI thing took off when everyone saw a weakness in search and said, hey, we can provide something that will break Google’s stranglehold. Frankly, this is a story about the years of failed know, antitrust work that, you know, should have been dealt with many years ago and wasn’t and so Google basically just controls a large sector of the internet along with, you know, along with Meta now for advertising. And that’s starting to break up a little bit, but it remains to be seen whether AI is going to be an advertising medium that’s equivalently lucrative to search, but who knows? going to give it a shot, but users are going to get sacrificed in the process.
Liam Proven (32:27)
It’s like an eternal verity of life in the technology market that, you know, if it’s true, there’s probably an XKCD about it. And there was an XKCD years ago, 1118.
“Remember when we prosecuted Microsoft for bundling a browser with an OS? Imagine the future we’d live in if we’d been willing to let one tech company amass that much power.”
“Thank God we nipped that in the bud.”
Nobody is too big to fail. And the bigger they come, the harder they fall. I think some mighty industries worth hundreds of billions are going to come to grief over this stuff. And I haven’t got lot of sympathy.
Brandon (33:08)
I guess we’ll see. We’ll see if this will be enough to, you know, clean some of that enshittification off the walls of the internet in the coming years.
Liam Proven (33:16)
What a beautiful phrase, well said.
Brandon (33:08) But hey, no matter, yeah, no matter if it happens or not, we’ll probably still be here and we’ll probably still be talking about it the Kettle, so be sure to tune in. Thanks for joining us. ®
A USB cable is not typically something that raises eyebrows. Most people plug one in and move on. But a Kickstarter device is challenging that assumption by packing a surprising amount of computing power into something that looks completely ordinary.
Read Entire Article
Source link
Telecoms giant files suit in Golden State so it doesn’t have to maintain network it claims is hardly used
AT&T wants to ditch its traditional copper phone line infrastructure
in California in favor of fiber everywhere, claiming it has to spend $1 billion
each year on a telephone network that a tiny percentage of customers use.
The US telecoms giant announced plans this week to invest $19
billion in The Golden State between now and the end of the decade to bring
fiber to more than 4 million additional households and businesses, upgrading customers
to the newer infrastructure.
As part of its plans, the telco has filed a lawsuit [PDF] against
several state officials seeking a court order to overturn California rules that
require AT&T to continue offering a “plain old telephone service” (POTS).
AT&T points out that the Federal Communications
Commission (FCC) recently adopted
rules that encourage telcos to retire their aging copper lines.
The Washington-based telecoms regulator said the expansion
of fiber cabling is hindered by “the need for carriers to divert precious
resources to the maintenance of deteriorating legacy networks that deliver
outdated services to an ever-decreasing number of subscribers.”
In its court filing, AT&T says “the copper wires
that once served every home now serve just 3 percent of households in
AT&T’s California territory,” but complains that state-level “Carrier of Last
Resort” (COLR) rules require it to continue supporting and maintaining POTS
even after the FCC has authorized the service to be phased out. Under basic pre-emption
principles, those COLR rules cannot stand, it asserts.
But while the telco likes to portray this as bringing
faster and more reliable modern network technology to all California residents,
critics say rushing to phase out the old phone network could
leave some users behind.
A nonprofit public interest group, Public Knowledge, previously warned the FCC directive could impact consumers in rural areas, the
elderly, those with disabilities, and anyone who relies on specialized medical
equipment that uses phone lines.
As The Register has previously covered, the UK’s former state-level
operator BT was forced to delay plans to turn off the public switched telephone network
(PSTN) and replace it all with all-fiber infrastructure after similar concerns
were raised. This followed the introduction of a government charter to protect
vulnerable customers, particularly those using TeleCare, which supports alarms
that the elderly or infirm can trigger if they need emergency assistance.
AT&T said it will take “a thoughtful, phased
approach to upgrade customers,” and claimed “no customer will be left
without access to phone or 911 service.”
However, Public Knowledge said the FCC order relaxes or
entirely drops various safeguards put in place by previous US administrations, including the requirement to prove through engineering tests that a new service adequately replaces the old for medical equipment and alarm systems.
®
I recently had the opportunity to sit down with Francis de Souza, COO of Google Cloud, backstage at an event in Los Angeles. Amid the din around us, de Souza, who speaks in the calm, measured manner of a university professor, offered useful advice for companies navigating the AI security moment we’re all living through, noting that “there’ll be a transition period, and then I think we get to this better place.”
He wasn’t speaking about Google at that moment, but it’s clear that even Google is still figuring things out.
De Souza’s core message was one security professionals have been trying to get executives to internalize for years, now made urgent by AI: security can’t be an afterthought. “As companies embark on this AI journey, they need to take a platform approach,” he said. “Security is not something you can bolt on later, and it’s not something you can leave up to employees to do on their own.” He warned specifically about “shadow AI” — employees reaching for consumer tools without organizational oversight — and argued that companies need to demand security, governance, and auditability from their platforms from the start. “There’s no such thing as an AI strategy without a data strategy and a security strategy. They need to go hand in hand.”
Worth noting: he wasn’t pitching Google Cloud alone. When I observed that his advice sounded like a Google advertisement, he pushed back. Google, he said, is committed to a multicloud approach, and he made the case that companies that think they’re operating on a single cloud almost certainly aren’t. “Even if they pick a single cloud, they’re relying on SaaS applications, there are business partners that may be using different clouds,” he said. “It’s important for companies to have a security posture that is consistent across clouds, across models.”
He also made the case that the threat landscape has changed so fundamentally that old defensive models are too slow. He noted that the average time between an initial breach and the handoff to the next stage of an attack has dropped from eight hours to 22 seconds, and that the attack surface has expanded well beyond the traditional network perimeter. “In addition to your usual estate, you have models now. You have data pipelines used to train the models. You have agents, you have prompts. All of this needs to be protected.”
One threat de Souza flagged that doesn’t get enough attention: agents moving through a company’s internal systems can surface forgotten data repositories that nobody has thought about in years. “A lot of organizations have old SharePoint servers [and access controls] they haven’t really updated, but it didn’t matter because nobody really knew where they were. But agents roaming your enterprise will find those data assets and will expose the data on them.”
The answer, in his view, is to meet machine speed with machine speed. “We’re now seeing the emergence of an AI-native, fully agentic defense where organizations can run agents driving their defense,” he said. “Instead of having a human-led defense or even a human in the loop, you can now have humans overseeing a fully agentic defense.” He added that this has become a leadership issue, not just a technology one. “This is a board-level issue and an executive team issue. It’s not just a security team’s issue.”
But even as AI takes on more of the defensive workload, the people qualified to oversee it are in short supply — and the vulnerabilities that AI itself is introducing are multiplying faster than security teams can address them. “We’re going to need people to deal with the bug-pocalypse,” LinkedIn’s chief information security officer Lea Kissner told the New York Times this week, adding that she doesn’t expect the industry to understand AI security in any sustainable long-term way for at least several years.
Which brings us back to the platform providers themselves. The Register has published a series of reports over the past several weeks documenting a wave of Google Cloud developers hit with five-figure bills following unauthorized API calls to Gemini models — services many of them had never used or intentionally enabled. The cases followed a familiar pattern: API keys originally deployed for Google Maps, placed publicly per Google’s own instructions, had quietly become capable of accessing Gemini after Google expanded their scope without clearly disclosing the change.
Rod Danan, CEO of interview-prep platform Prentus, said his bill hit $10,138 in roughly 30 minutes after attackers exploited his compromised API key. Isuru Fonseka, a Sydney-based developer whose account was similarly compromised, woke up to charges of roughly AUD $17,000 despite believing he had a $250 spending cap in place. What neither knew was that Google’s automated systems had upgraded their billing tiers based on account history, raising their effective ceilings to as high as $100,000 without explicit consent.
Google refunded both after The Register published its initial report. Still, Google told The Register it has no plans to change its automatic tier-upgrade policy, saying it prioritizes preventing service outages over enforcing users’ stated budget preferences.
In the meantime, there is the separate question of what happens when a developer tries to shut things down. The Register reported this week on research by security firm Aikido finding that even developers who catch a compromised key and immediately delete it may not be safe. According to Aikido’s findings, attackers can apparently continue using that key for up to 23 minutes because Google’s revocation propagates gradually across its infrastructure. Aikido researcher Joseph Leon told The Register that during that window, success rates are unpredictable — in some minutes over 90% of requests still authenticated — and attackers can use the time to exfiltrate files and cached conversation data from Gemini.
Leon also noted that Google’s own newer credential formats don’t appear to have the same problem: service account API credentials revoke in about five seconds, and Gemini’s newer AQ-prefixed key format takes about a minute. “Both run at Google scale,” he wrote in Aikido’s related paper. “Both suggest this is technically solvable for Google API keys, too.” In short, according to Leon, the 23-minute window isn’t an engineering constraint but a matter of priorities for the company.
That’s worth considering when reading de Souza’s advice, which is sound and should be taken very seriously. He’s not wrong, but there is currently a gap between the platforms are prescribing and how fast they are themselves adapating, and it’s good to be aware of this, too.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
In recent years, cryptocurrency theft operations have evolved far beyond isolated phishing pages and fake NFT mint scams. What once consisted mainly of individual actors running malicious wallet-connection pages has increasingly developed into a structured underground service economy built around “Drainer-as-a-Service” (DaaS) platforms.
Unlike traditional malware operations, crypto drainers typically rely on social engineering rather than device compromise. Victims are lured to fake crypto, NFT, airdrop, or DeFi websites and asked to connect their wallets. Once a malicious transaction or wallet signature is approved, the drainer can transfer cryptocurrency assets directly from the victim’s wallet, often within seconds.
An analysis conducted by Flare researchers of approximately 700 posts collected from underground forums, chats, and channels related to the “Lucifer DaaS” between January 2025 and early 2026 provides a rare look into how modern drainer operations function internally.
The findings reveal an increasingly professionalized ecosystem focused on affiliate growth, automation, phishing scalability, wallet-security bypasses, and operational resilience.
The analyzed data suggests that modern drainer operations increasingly function similarly to legitimate SaaS businesses. Actors behind Lucifer discussed software releases, bug fixes, affiliate commissions, customer support, hosting recommendations, deployment automation, website cloning, and referral systems, offering a deep dive into how DaaS ecosystems are evolving inside underground communities.
A crypto drainer is a tool designed to steal cryptocurrency assets directly from victims’ wallets by abusing wallet permissions and transaction approvals. Instead of hacking the wallet itself, attackers typically lure victims to fake crypto, NFT, airdrop, DeFi, or token-claim websites and trick them into connecting their wallets and approving malicious requests or signatures.
Once permission is granted, the drainer can automatically transfer tokens, NFTs, or other digital assets from the victim’s wallet to attacker-controlled wallets, often within seconds and across multiple blockchains.
In this model, the operator develops and maintains the draining infrastructure, while affiliates bring victims. The affiliate’s job is to generate traffic through phishing links, fake websites, compromised social media accounts, ads, spam, or direct messages. The DaaS operator handles the wallet interaction, transaction logic, alerts, and asset-draining flow.
The Lucifer dataset shows this model clearly. In one promotional post, the actor explains that affiliates provide “traffic through phishing links, fake websites, and similar methods,” while the service manages “signatures, approvals, and token transfers.” The same post describes the service as commission-based and presents Lucifer Drainer as a “professional solution” with ERC20 support, Permit2, off-chain signatures, wallet-security bypasses, multichain support, and continued product updates.
That language is important. The operators are not selling a one-time malware kit. They are selling participation in a platform.
Their Telegram channel reinforces the same point. Lucifer repeatedly states that the software is “not for sale,” and that the operators take a 20% commission from successful “hits.” In May 2025, the channel wrote that it does not sell or lease the software and only splits “20% per hit.”
This is closer to the ransomware affiliate model than to old-school phishing kits. While the developers maintain the product, the affiliates bring traffic to monetize the operation and the profits are shared.
DaaS platforms like Lucifer recruit affiliates through underground forums and Telegram channels — the same sources Flare monitors continuously.
Flare tracks drainer ecosystems, phishing infrastructure chatter, and credential exposure across thousands of dark web sources, so your security team sees threats before they reach your users.
The Lucifer channel shows a drainer operation evolving publicly into a structured DaaS platform.
In March 2025, the group announced version 6.6.6, advertising ERC20 support, Permit2 abuse, off-chain signatures, Telegram notifications, wallet-security bypasses, and multichain functionality. The same announcement again emphasized that the software was not for sale and that the operators take a 20% commission from successful “hits.”
From then on, the channel increasingly resembled a software development feed more than a typical malware operation. The operators announced bug fixes, wallet compatibility updates, Telegram-browser support, deployment improvements, and hosting features.
One of the most notable additions was a website-cloning feature that allowed affiliates to clone phishing pages and receive ZIP files preloaded with the latest Lucifer code.
Over time, the operation moved heavily toward automation. Later updates introduced “Zero Config” deployment workflows, allowing affiliates to upload static files, automatically generate phishing-ready packages, and deploy infrastructure with minimal manual work. This significantly lowered the technical barrier for affiliates.
The broader dataset also shows Lucifer actively recruiting across underground communities where other drainer brands such as Inferno, Angel, Venom, Nova, Ghost, Medusa, Vega, and Monkey were discussed. A recurring theme across the posts was “traffic.” The operators repeatedly emphasized that affiliates needed victims and phishing distribution capabilities more than advanced technical skills.
However, the group also warned that complete beginners were not welcome, suggesting the operators prioritized experienced affiliates capable of generating reliable phishing traffic with limited operational overhead.
Like other underground services, Lucifer also shows signs of operational resilience.
In August 2025, their Telegram bots were banned, so they instructed users in their channel to create new bots and grant them admin privileges. The group also gave instructions for resolving configuration problems after migration.
In November 2025, Lucifer said a documentation domain hosted on Google Firebase had been suspended after research reports. The group responded by moving documentation to InterPlanetary File System (IPFS is a decentralized, peer-to-peer file-sharing protocol used to store and distribute data), presenting decentralization as a way to keep operations running after takedowns.
This mirrors behavior seen across the wider drainer ecosystem. Check Point’s research on “Inferno Drainer” described how the operation continued adapting despite wallet warnings, blacklists, and anti-phishing defenses.
Drainers became popular because they match the structure of modern crypto crime.
Crypto assets are liquid, fast-moving, and often irreversible once transferred. Attackers do not need to compromise a bank portal or wait for a mule account. A successful wallet approval can immediately “drain” assets.
They also benefit from user confusion. Wallet prompts, approvals, signatures, permits, and token allowances are still difficult for many users to understand. Attackers exploit that complexity by making malicious prompts look like routine Web3 interactions.
The abuse of the authorization mechanisms Permit and Permit2 became especially attractive because these mechanisms can allow token transfers through signed permissions rather than obvious direct transfers. That makes the user interaction feel less alarming, while still giving attackers a path to assets.
The findings suggest that Lucifer is part of a much broader underground ecosystem that includes operations and other wallet-draining services competing for affiliates, traffic, and visibility across underground communities.
The analyzed Lucifer dataset provides a rare public look into how modern DaaS operations function behind the scenes. The collected posts reveal an ecosystem focused on continuous development, affiliate retention, infrastructure resilience, automation, and operational scalability.
The findings also highlight how modern crypto-drainer operations increasingly resemble legitimate SaaS businesses. Rather than selling a static phishing kit, DaaS operators now maintain active platforms designed to simplify deployment, reduce technical barriers, and maximize affiliate efficiency.
Features such as website cloning, automated ZIP deployment, “Zero Config” workflows, affiliate commissions, and support channels demonstrate how operational maturity has become a competitive advantage within the ecosystem.
Crypto drainers are no longer isolated phishing pages operated by individual actors, but increasingly structured service platforms built around scalability and repeatability. As these ecosystems continue lowering the technical barrier for affiliates, wallet theft operations may become more accessible, more automated, and more difficult to disrupt at scale.
DaaS platforms are designed to make malicious wallet interactions look routine. Knowing what to look for is the first line of defense. Watch for these warning signs before connecting your wallet to any crypto site:
Wallet connection requested immediately on a crypto/NFT/airdrop site.
Unexpected signature or “Approve” requests before receiving anything.
Requests for unlimited token approvals or Permit/Permit2 permissions.
“Gasless claim” or “off-chain signature” prompts that still require wallet approval.
Fake urgency: “claim now,” “wallet verification,” “limited mint,” “expiring rewards.”
Links received through Telegram, Discord, X/Twitter DMs, or fake support accounts.
Recently created or suspicious-looking crypto domains.
Websites cloned from legitimate DeFi, NFT, or exchange platforms.
Multiple redirects before reaching the wallet prompt.
Wallet warnings ignored or bypassed.
Using a main wallet with large holdings for unknown Web3 sites.
Repeated prompts to reconnect or re-sign transactions.
Influencer or project accounts suddenly pushing unexpected mint/claim links.
Browser tabs opening new wallet approval windows automatically.
Transaction details that are vague, empty, or difficult to understand.
“Free NFT” or “free token” campaigns requiring approvals first.
Discord or Telegram admins privately messaging users first.
Websites asking users to disable wallet security protections.
Wallet drained immediately after signing a message instead of sending funds manually.
Any platform pressuring users to act fast before verifying legitimacy.
Flare provides early visibility into fraud operations before they reach victims. By monitoring underground forums, Telegram channels, and marketplaces, Flare detects leaked data, victim lists, and recruitment activity tied to Caller-as-a-Service campaigns.
This allows organizations to proactively respond (reset credentials, alert users, and strengthen defenses) before attackers strike, reducing both risk and impact.
Sponsored and written by Flare.
There was a time when Craftsman’s return policy was legendary. You used to be able to walk into any Sears and get a brand-new tool on the spot. It didn’t matter if it was a factory defect or user error that broke the tool; you’d get a replacement, no questions asked. This all changed in the late 2010s after Stanley Black and Decker purchased the brand, upon which the wording on Craftsman’s tool warranty became significantly more restrictive.
There is still a lifetime warranty for certain hand tools and mechanics tools, though other products have more limited warranties, either in the types of damage covered or the length of coverage. Craftsman’s power tools, for example, only have warranties ranging from one to three years, depending on the tool. In any case, Craftsman products must be returned to an official retailer such as Lowe’s or Ace Hardware, and this is where some users have encountered friction. Some buyers stated that exchanges have been refused outright, while others have claimed that stores may not offer replacements for outdated models.
While Craftsman’s warranty is comparable to most other brands on the market today, it’s no longer necessarily outstanding. Several other tool brands also offer lifetime warranties on hand tools, and some have coverage that’s better than what Craftsman currently provides. Those who are thinking of investing in a brand and want to feel secure in their purchases might first want to check what sort of coverage these other brands offer.
Tekton is a family-owned business based in Grand Rapids, Michigan, that makes a wide range of hand tools. The brand has a reputation for quality and offers some pretty impressive coverage to complement it. In fact, some might argue that Tekton has the best and most customer-friendly warranty policy in the tool industry today. The company’s policy is simple: If a tool doesn’t work the way it’s supposed to, the company will replace it. There are no time limits, and it doesn’t matter how old a tool is or how long it’s been since it was purchased. You don’t need to worry about shipping costs, nor do you need to have a receipt. This is particularly nice for hand-me-down tools or those purchased second-hand.
The process is simple. All you need to do is take a picture of the broken tool and upload it to the Warranty page on the Tekton website along with the tool’s item number and a brief description of what’s wrong with it. You then provide your name, address, and contact information, and then Tekton will ship a new one to your home for free. You don’t even need to leave your house.
Reddit is full of first-hand accounts from buyers who have used Tekton’s warranty claim service and experienced no issues. Many have also claimed that replacement parts arrived within just a few days, with some even receiving replacements the day after they filed the report.
Harbor Freight has a reputation as a budget tool retailer. Much of the company’s business model is based on cutting out the middlemen, offering popular tools through its own store-owned brands at lower prices than the competition. The company also has a range of warranty policies for its different brands and tool types, some of which are pretty great.
The company’s best warranty is for its hand tools. If you have a broken Harbor Freight hand tool, you can walk into any Harbor Freight, and they will swap it out for a new one on the spot if you’re the original owner, replacing older models with comparable new ones if a product has been discontinued. This applies to all hand tools in the Pittsburgh, Quinn, Doyle, and Icon lines.
Many Reddit users have even claimed that they didn’t need a receipt to claim a warranty, and that they were able to walk into the store with a broken tool and walk out with a new one, no questions asked. That said, others have suggested making an account, as it will allow Harbor Freight to track your purchase history and pull up proof of purchase if necessary. The company’s Hercules brand also boasts an impressive 5-year limited warranty for its power tools, significantly better than the 3-year warranty offered by Craftsman.
Sonic Tools is best known for its automotive and aviation products as well as its Sonic Foam System storage solutions. The professional-grade manufacturer is popular among mechanics and industrial technicians alike, and it promises a lifetime warranty.
Like Tekton, Sonic Tools has an online warranty claim process. Start by going to the Warranty page on the Sonic Tools USA website and filling in your personal information, shipping information, the reason that you’re claiming the warranty, and the tool’s part number. You then attach photos of the tool and a close-up of the printed part number on the tool and submit the form. Sonic claims that it will process the warranty within 24 hours and immediately ship out a replacement tool. This doesn’t require a receipt or any other form of proof of purchase. This warranty covers most Sonic Tools products, with only a few caveats regarding consumable items, products not marketed under the Sonic Tools brand, and items that have been subjected to clear misuse or modification.
While not all users are satisfied with Sonic Tools’ build quality and pricing, the sentiment regarding the company’s warranty is extremely positive. Redditors have reported receiving replacement tools very quickly, sometimes within a week of submitting through the portal, and it’s hard to find anyone who claims to have had a bad experience with the warranty process.
Kobalt, Lowe’s in-house brand, has an exceptionally large catalog of hand and power tools. These tools are often on the budget side of the spectrum, but are well known for offering decent quality and performance. Like Craftsman, not every product that Kobalt makes is covered by the same warranty. It offers 1-year, 3-year, 5-year, and lifetime guarantees, with power tools typically getting the 5-year guarantee and hand tools generally getting lifetime coverage. On top of this, Lowe’s offers a satisfaction guarantee that allows you to return or replace nearly any product you aren’t happy with within 90 days.
To make an exchange, you just need to take the tool to any Lowe’s. Most warranties only cover material and workmanship defects and require valid proof of purchase. That said, Lowe’s lets users create an account to track their purchase history, which can be used instead of a physical receipt. Additionally, products covered by Lowe’s lifetime guarantee can be exchanged, no questions asked.
On paper, you should be able to get any warrantied tool replaced at your local Lowe’s, but owners’ experiences have varied. Some buyers have stated that the process is smooth and easy, but others have claimed to have had difficulties getting Lowe’s to honor the warranty in-store and were told to contact Kobalt for a replacement instead.
Another automotive tool brand with a top-quality warranty worth considering is SK Professional Tools. The company has been a staple for decades and specializes in high-end, industrial-quality hand tools, and it offers a limited lifetime warranty on all of its products. This warranty covers damage acquired with normal use as well as any manufacturing defects, but doesn’t cover damage caused by misuse or modification.
To file a claim, you’ll need to go to the Warranty Claim section on the SK Professional Tools website. This gives you the option to request a return for store credit, exchange the broken tool for a comparable product, or receive a ratchet or breaker bar repair kit to fix your existing tool. You’ll then enter the product information, a description of the reason for the claim, a photo of the product, and your personal and shipping information. Once this is completed, the company’s customer service team will contact you and provide you with return instructions.
This isn’t quite as hassle-free as some of the others, but it’s still a relatively simple return process with great coverage. Owners’ real-world experiences back it up, too, with customer reports on Reddit outlining positive experiences with SK’s return process. Some of them also claimed that they were able to resolve warranty claims simply by calling the company’s customer service line.
Craftsman was among the first tool brands to offer a lifetime warranty on its hand tools. That said, the company’s warranty, while still competitive, isn’t as legendary as it once was. There are now several other brands that offer lifetime warranties on their hand tools and many that offer longer coverage periods on their power tools.
To choose brands that offer coverage as good or better than Craftsman, we started by looking at the top tool brands and examining their warranty periods. Narrowing it down to options that offered lifetime warranties on hand tools and exceptional warranties on power tools (when applicable), we dug deeper into the return process to find the ones with the simplest warranty processes. We also screened out brands with excessive loopholes that allow them to avoid replacing a tool under reasonable circumstances.
Once we selected our brands, we turned to owner reports and experiences, primarily on Reddit, to see how well the return systems work in practice. That way, a potential tool buyer will have as detailed a picture of a brand’s warranty coverage as possible before they spend their hard-earned money.
“Canonical says Ubuntu Pastebin will be decommissioned at the end of May 2026,” writes Slashdot reader BrianFagioli, “as part of an infrastructure modernization effort.”
The announcement only appeared this week, giving the Linux community barely any warning before a service that has been tied to Ubuntu support culture for years suddenly disappears.
Ubuntu Pastebin has long been used for sharing logs, crash reports, config files, and terminal output across IRC, Ask Ubuntu, forums, bug reports, Reddit, and countless troubleshooting guides scattered around the internet. The bigger concern is link rot. Once the shutdown happens, years of old support discussions could lose critical debugging information overnight. Community members have already pointed out that some Ubuntu packages and scripts still reference paste.ubuntu.com directly.
While it is understandable that aging services eventually get retired, the extremely short transition period is rubbing many Linux users the wrong way, especially in a community where old documentation and archived troubleshooting threads still regularly help people solve problems a decade later.
Storage is expensive these days, whether you’re looking at the prices of spinning rust or magic little sticks of silicon. But what if there was some benevolent overlord that you could trick into giving you unlimited storage? That’s where Noisecloud comes in.
Created by [Lucas], Noisecloud is a tool that lets you use YouTube as a form of effectively-unlimited file storage. It works by taking whatever file data you have on hand, and turns it into frames of digital noise that can be stored and transported as an MP4 file and uploaded to YouTube. The encoding process involves first compressing the data with gzip, then packaging it into a high-constrast series of video frames that are then encoded with FFmpeg. Video containers can be produced in various resolutions, all the way down to 640×360 @ 30 fps. There’s also a special “TikTok mode” which is optimised to best preserve data on short form sites that use vertical orientation as default. More commentary from the creator is available via the supporting article on Github.
It’s probably not a practical way to store your files, given the fussy encoding and decoding required to actually use the data. However, it’s an interesting proof of concept that explores how data can be stashed in unexpected places via publicly-accessible services. We’ve explored similar work before, too.
Recently, the biggest trend in kitchen gadgets has been “hands-free” and AI-powered devices that act as automated countertop assistants. There are plenty of devices that exist now for people who want to cook more (or at least look like someone who has their life together) but don’t always have the energy for a full kitchen marathon after work.
From a robot stirring your soup to a bread machine that kneads your dough while you watch TV, here is a list of gadgets that may make you feel like you’ve won adulthood. Or at least make cooking feel much less intimidating.
The Nosh Chef Robot is a huge upgrade from a slow cooker or Instant Pot, as it can manage much of the cooking process autonomously.
The AI-powered robot dispenses exact amounts of oils, spices, and ingredients from reusable ingredient cartridges. Users still need to load ingredients beforehand, but once everything is in place, the robot can roughly chop, stir, sauté, portion, plate, and self-clean after meals. However, it can’t bake, roast, or steam, so there are limitations, but the company says it supports more than 500 dishes, such as stir-fry and curry.
The system runs on NoshOS, a proprietary AI trained on thousands of recipes and cooking techniques. Built-in sensors monitor moisture, texture, and browning levels in real time, adjusting heat and seasoning throughout the cooking process. It can even recognize ingredients already loaded into the device and recommend meals based on what’s available.
The Nosh One is currently available for preorder on Kickstarter, with shipments expected in summer 2026.
An automatic soup stirrer sounds unnecessary until you use it once, and suddenly you’re hooked.
Instead of standing over the stove painstakingly stirring soup, sauce, risotto, pudding, or oatmeal, the StirMate Automatic Pot Stirrer rotates around the pot for you while you prep other ingredients, answer emails, or scroll on your phone.
It could also serve as a helpful accessibility tool for people with mobility issues or chronic pain.
Developed by father-and-son company StirMate, the third-generation model launched recently and includes a stronger motor, adjustable speed settings, and redesigned paddles for thicker recipes. It can run for up to 10 hours on a single charge and recharges in about an hour.
Modern bread machines have evolved far beyond basic sandwich bread. This newer smart model from KitchenArm automates the mixing, kneading, proofing, and baking process, turning homemade bread into a mostly hands-off experience. Just add ingredients, select a setting, and let the machine do the work.
The KitchenArm Smart Bread Machine includes 29 automatic programs with 21 bread settings, including white, French, whole wheat, rye, and sweet breads, plus non-bread options for yogurt, jam, and cake. There’s also a fully customizable “Homemade” mode for adjusting kneading and rising times manually.
Morning routines are significantly easier when your coffee machine remembers your order and the usual time you want to drink it.
The De’Longhi Rivelia is a newer option and has recently garnered attention for its smart personalization features. In addition to grinding beans, brewing espresso, and frothing milk automatically, the Rivelia supports up to four user profiles, remembers favorite drinks and strength preferences, and adapts recommendations over time based on usage habits. Its “Coffee Routines” feature can even suggest beverages depending on the time of day.
While it’s definitely expensive, it’s widely considered one of the most popular high-end espresso machines currently available.
Store-bought oat milk prices alone are enough to push some people into making their own. The Nama M1 automates the entire process of making almond, oat, soy, or cashew milk, eliminating the old method of soaking, blending, and then straining that previously made homemade plant milk feel like a full-time job.
Newer nut milk makers have become faster, smarter, and much easier to clean, and the Nama M1 is one of the more widely reviewed examples currently on the market. Using centrifugal force, it can produce creamy plant milk in a few minutes with minimal prep work.
The KitchenArt Auto-Measure Spice Carousel is one of the simplest products on this list, but it solves a very real problem: accidentally dumping half a container of garlic powder into dinner because the spice lid suddenly betrayed you. This rotating carousel stores up to 12 spices and dispenses measured amounts in 1/4 tsp amounts or poured normally through the built-in spouts.
No apps, no AI, no complicated setup. Just a genuinely practical kitchen tool.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Blockchain.com files with SEC for U.S. IPO
Holiday Weekend Open Thread – Corporette.com
Bitcoin Accumulation Weakens as BTC Realized Losses Hit $600M
Dell Technologies DELL Stock Surges 15% on AI Server Momentum and Analyst Upgrades in 2026
Space X IPO Is ‘Bad News’ for Tech Stocks: But What About Bitcoin?
Makerfield: a tale of two social-media histories
MicroStrategy’s Saylor Says Miners No Longer Set Bitcoin Price, Another Force Has Taken Over
Robinhood crypto COO Tanya Denisova exits
NYT Strands Answers May 24 2026 Revealed for Puzzle No. 812 Theme Summer Essentials
WhatsApp ads could make Irish debut after discussions with DPC
A 0.12% parameter add-on gives AI agents the working memory RAG can’t
AI infrastructure race heats up as IREN pitches full-stack strategy, WhiteFiber lands $160M deal
Trump Invests $1M-$5M in Kura Sushi USA Chain With 27 California Locations
You Can Now Add ChatGPT To PowerPoint
Revolut Launches Dogecoin Debit Card Across UK and EU
Charity run by Reform leader Malcolm Offord accused of ‘law breaking’ over Scottish registration
2026 CJ Cup Byron Nelson leaderboard: Brooks Koepka finds putting stroke in Round 1
Trump Media’s Bitcoin Stash Shrinks Again as 2,650 BTC Lands on Crypto.com
Goldman Sachs reinstates Ageas stock coverage with neutral rating
Exa Labs raises $250 million in funding led by a16z
You must be logged in to post a comment Login