Cindʎ Xiao 🍉

I am not very active here, find me on Mastodon: infosec.exchange/@cxiao Longer post char limits and more actual infosec practitioners there. If you think "you naive fools just need to UNDERSTAND AI's capabilities to see how great it is!": It is unlikely we will get along unless I already know you.

Join me for the fall session of Deconstructing Rust Binaries! 4 days of me teaching you how to reverse Rust binaries (:

man, shut the fuck up

Slides for my #RustConf 2026 talk are now up! A recording will be posted some time after the conference as well, I'll post it when it's up.

I'm here at #RustConf! I have cool cards! Feel free to find me after my talk, message me here, or message me on the conference Discord (you can find me in my talk's channel `#reverse-engineering-rust-malware-in-2026`) if you want to get one of these!

Woo first copies are here! Our Hearts Burned For Home, on sale very soon October 12. The book unearths the untold story of Uyghur exiles who fled China’s expanding police state—only to become a pivotal force behind the fall of Bashar al-Assad’s regime. globalreports.columbia.edu/books/our-he...

If you'll be attending #RustConf in Montreal, and are interested in Rust malware, come find me and say hi! You can also watch the livestream and join the live Discord from home with a Virtual conference ticket, it's pay-what-you-want ⬇️ My talk will also be recorded and posted after!

I finally released this binja plugin! check it out for all your Rust reversing needs

🕯️

The Rust-based backdoor observed in the supply chain compromise of the `arrayref` Rust crate has been added to the Rust Malware Sample Gallery: github.com/decoderloop/... #rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing #macOS #SupplyChain #arrayref

AmnesiaStealer, an infostealer for macOS machines, has been added to the Rust Malware Sample Gallery: github.com/decoderloop/... #rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing #macOS #infostealer #AmnesiaStealer

Still Toolkit has been added to the Rust Malware Sample Gallery: github.com/decoderloop/... Still Toolkit is notably used against Russian organizations. The dropper that delivers it is written using @tauri.app #rust #malware #infosec #ReverseEngineering #ArmoredLikho #EagleWerewolf #Tauri

Staying with Hong Kong, @niaocollective.bsky.social posted: An expanded blog post on Eye injuries caused by Hong Kong Polices deliberate use of so called "less-lethals" And a🧵on the 2019 observation of hungry ghost festival bsky.app/profile/niao... And a great thread on engineering with bamboo! 12/

AI anchors and AI-generated dramas are growing rapidly in China. But how far can a generative persona go before the illusion is broken? Meet Peach Fang. Check out our latest feature on CMP and LS!

虽然这些数字不准确但是threads真的在台湾很火，而在海外华人圈儿也有很多人用。bluesky这里基本上还是西方英语网站，随便搜一下也找不到很多关于台湾的国语新闻。我感觉蓝天上的西方人太把自己当成世界中心了，实际上蓝天还是一个很小的平台

oh HELL no why tf is this the default

We've just added these #RustLang #malware samples to the Rust Malware Sample Gallery: 1) JitterDropper 2) A Rust-based clipboard hijacker 3) #IronWorm, a Rust-based infostealer observed in several recent supply chain compromises 4) LabubaRAT github.com/decoderloop/... #infosec #reversing

If you missed the spring session of Deconstructing Rust Binaries: I'll be teaching it again this fall! October 26-31, fully virtual, all Rust RE (:

什么是“中华灯塔派”？ 从曾经向往毛时代中国的西方左派，到今天被DeepSeek、高铁和中国城市景观震撼的网红与知识分子，他们都在用同一种方式想象中国：高效、稳定、有秩序，甚至是另一种现代化答案。 查建英说，现在看到的也许只是“一袭华丽的长袍”，而底下的虱子，迟早会浮上来。 欢迎收听、收看本期下午茶： youtu.be/3jzyYjwM5Nw

China Daily president and editor-in-chief Qu Yingpu said AI is evolving from a “cognitive tool” to an “action tool.” Read more on our CMP website or Substack: chinamediaproject.org/2026/07/09/t... linguasinica.substack.com/p/the-propag...

See you at RustConf! :D

I will be at @nsec.io tomorrow and Friday, if you're there too and would like to meet up let me know! :D #NorthSec #nsec

Very excited to present at RustConf this year! :D

Device code phishing is exploding, and AiTM actors are getting in on it. We found ODx phishing-as-a-service providing device code capabilities in addition to their AiTM offerings. ODx is one of the most popular AiTM kits currently. It's also tracked as Storm-1167 and FlowerStorm.

What moral injury comes of being called racist when racism is so thoroughly rewarded?

my father was a grassroots bureaucrat who hung out with other grassroots bureaucrats. at a family banquet, my relative said telling me about politics would be 对牛弹琴 (lit. playing the lute to a cow) chenchenzhang.net/2026/05/01/o... read on and it gets more interesting

Again, before we make trade-offs in civil liberties for nominal security, why not look at the world's largest age-gating experiment to see if it even helps? www.project-syndicate.org/commentary/c...

Installez-vous confortablement, détendez-vous et regardez comment nous retirons doucement le support papier acide au dos d’une estampe! Écouteurs recommandés 🎧 #ASMR #Restauration youtu.be/hIf46oI8XpU

Good day yesterday, picked up the new @thepeopleswant.bsky.social book (published by @haymarketbooks.org) from my local bookstore. As a coincidence, it was also #IndieBookstoreDay! I think @brianhioe.bsky.social mentioned during the book launch event that there is a Chinese version coming too (!!)

the irony of having a one-on-one HR layoff meeting in the conference room with my Loki mural on it

It's such a low-key resistance move but talking about not using AI, especially in a professional context, is so important in working against "inevitability" narratives and so powerful in identifying who your people are — and in ensuring there are more of us all the time.

We’re cooking on Beyond the Spider-Verse!!! So excited to share these new stills… see you in IMAX on June 18, 2027!! 🕷️

This posture also makes it hard for people to appreciate the many individual, marginal steps that are needed in combination. Incremental steps are too often dismissed as “magical thinking” that won’t “solve” “the problem.” As if there is a single problem or, somewhere out there, a single solution.

Memories of Hong Kong & Taiwan 💚

I'll be speaking at @rustconf.com in September! Looking forward to presenting on reverse engineering Rust binaries, to the Rust community! sched.co/2KHt7 #RustConf #RustConf26 #Rustlang #Rust

面对家庭暴力、关系伤害或其它暴力时，如何求助、去哪求助是亟需回应的问题。资源地图或许无法解决所有困难，但我们希望它能够在某一个时刻，为需要的伙伴提供方向和安全感。