Donncha Ó Cearbhaill

Excited to see Google publicly launch Intrusion Logging, the first purpose-built system to enable forensic investigations of advanced digital attacks on mobile. We @amnesty.org have collaborated with Android Security on it's design over the past two years securitylab.amnesty.org/latest/2026/...

The feature is opt-in for Pixel devices on Android 16+ with Advanced Protection Mode enabled. As it rolls out beyond Pixel, it should help protect more Android users who are often underserved and cannot afford the most expensive devices. blog.google/security/wha...

Excited to see Google publicly launch Intrusion Logging, the first purpose-built system to enable forensic investigations of advanced digital attacks on mobile. We @amnesty.org have collaborated with Android Security on it's design over the past two years securitylab.amnesty.org/latest/2026/...

Spyware forensic work has so far relied on incidental logs that were never designed for security analysis and are too often partial and short-lived. Now we have the possibility to detect advanced spyware, exploits and unauthorised physical access, even months after the fact.

Excited to see Google publicly launch Intrusion Logging, the first purpose-built system to enable forensic investigations of advanced digital attacks on mobile. We @amnesty.org have collaborated with Android Security on it's design over the past two years securitylab.amnesty.org/latest/2026/...

In January, a phishing message arrived on my Signal account, supposedly from "Signal Support." I was able to turned the tables on the attackers and get a unique view of the wide-scale campaign by the attacker's targeting journalists and politicians I was target #13,730 in their database.

Some in the German government have suggested moving away from Signal to other "secure" messengers. That's the wrong lesson. Signal's core security remains excellent. This would be like banning email just because some people got phished.

In January, a phishing message arrived on my Signal account, supposedly from "Signal Support." I was able to turned the tables on the attackers and get a unique view of the wide-scale campaign by the attacker's targeting journalists and politicians I was target #13,730 in their database.

Today's Der Spiegel cover story (by Marcel Rosenbach and team) reveals the wider impact of the campaign. Among the victims are multiple German ministers and the President of the Bundestag. The story also includes the findings from my independent investigation. www.spiegel.de/politik/deut...

In January, a phishing message arrived on my Signal account, supposedly from "Signal Support." I was able to turned the tables on the attackers and get a unique view of the wide-scale campaign by the attacker's targeting journalists and politicians I was target #13,730 in their database.

If the victim forwards that code back to "Support," the attackers gain access to the account and to all future messages, including group chats. In January the system was already at version v0.2.0.3, suggesting active, ongoing development.

In January, a phishing message arrived on my Signal account, supposedly from "Signal Support." I was able to turned the tables on the attackers and get a unique view of the wide-scale campaign by the attacker's targeting journalists and politicians I was target #13,730 in their database.

The automated system powering the campaign is named ApocalypseZ by its operators. Its codebase and operator interface are written exclusively in Russian. The attackers were also translating victim communications into Russian.

🚨 A huge leak exposes the new targets and internal operations of Intellexa, the secretive and murky company behind the notorious Predator spyware. Introducing #IntellexaLeaks, a joint investigation with partners @insidestory.gr, @haaretzcom.bsky.social & WAV Research Collective 🧵👇

Check out the create reporting today from our wonderful colleagues and partners! bsky.app/profile/etri...

🚨 A huge leak exposes the new targets and internal operations of Intellexa, the secretive and murky company behind the notorious Predator spyware. Introducing #IntellexaLeaks, a joint investigation with partners @insidestory.gr, @haaretzcom.bsky.social & WAV Research Collective 🧵👇

Toadya our research partners at Google TAG and Recorded Future (@julianferdinand.bsky.social) ) have published their own deep investigations into Intellexa bsky.app/profile/juli...

🚨 A huge leak exposes the new targets and internal operations of Intellexa, the secretive and murky company behind the notorious Predator spyware. Introducing #IntellexaLeaks, a joint investigation with partners @insidestory.gr, @haaretzcom.bsky.social & WAV Research Collective 🧵👇

The level of remote access is more extensive and lax than previously thought. Intellexa staff simply logged in with TeamViewer (!) to a remote Predator customer system. The video shows staff could see live targeting and infection attempts from EAGLE_2, a customer in Kazakhstan.

🚨 A huge leak exposes the new targets and internal operations of Intellexa, the secretive and murky company behind the notorious Predator spyware. Introducing #IntellexaLeaks, a joint investigation with partners @insidestory.gr, @haaretzcom.bsky.social & WAV Research Collective 🧵👇

Shockingly, the leaks shows that Intellexa kept REMOTE ACCESS to Predator systems deployed on government clients’ premises — meaning the company had the potential to see data about surveillance victims in real time..

🚨 A huge leak exposes the new targets and internal operations of Intellexa, the secretive and murky company behind the notorious Predator spyware. Introducing #IntellexaLeaks, a joint investigation with partners @insidestory.gr, @haaretzcom.bsky.social & WAV Research Collective 🧵👇