Let me break it down what's going on with this spam. 1./
2/ Reply spammers fight a cat & mouse games with platforms like #Twitter.
One way they get spotted is by the platforms examining links.
If spammers hammer a platform by sending the same link in a thousands replies to the same scam site, it's not hard to spot & scale blocking.
3/ Remember spam emails w/misspellings, weird names, blocks of garbage text, mixtures of words & numbers etc?
These were all tactics to avoid spam filtering done by looking at each of these things for patterns.
Each new filtering strategy = new workarounds.
4/ These incessant Twitter replies are doing the equivalent of old school email scammers.
They want targets to get curious & greedy like "oh cool look here's a website with an account that already has a balance...let me just log in & get rich!"
Who falls for this? Well...
5/ People greedily typing in the site URL & "logging in" see a big account balance!
1.5 million dollars in USDT
They are instantly rich!
But to get it out? Well looks like you'll need to talk to the scammers.
& maybe sign up for the "VIP plan"
6/ Here's the thing. Platforms don't just look at the text & links of posts for evidence of spamming.
(Reports help too)
They scrutinize things like IP addresses & tech used for account creation & posting.
Enough signals of badness & you can scale up blocking.
7/ Speculation: anti-bot filtering that should happen before anyone can create an account or post... is failing.
So spam accounts are posting like crazy.
Then avoiding #Twitter's secondary defenses (e.g. text & URL filters) by mucking up their URLs to be less blatant.
8./ Reply spam is a numbers game.
Hope some users see a reply. (e.g. 14 views on a 60k tweet ain't great but...)
Eventually you get one user ready to go the whole way & get conned.
Even if 99.99999999% of us don't, there's still potential for ROI.
9/ Now, here's the thing. You have seen this reply spam for a while because the network has been up before.
Here are some more damming revelations as Intellexa, the shady, sanctioned spyware supplier gets exposed by @AmnestyTech & partners.. /1
2/ First, a mercenary spyware myth has just been busted.
Because the leak shows an Intellexa employee directly accessing a customer deployment.
Prior to the #PredatorFiles leak, spyware companies basically always claimed they couldn't access customer deployments & didn't know what was going on there.
They used this to avoid responsibility & claim ignorance when faced with abuses.
3/ And it gets crazier. The leak shows Intellexa casually accessing a core backbone of Predator deployment of a government customer.
Seemingly without the gov's knowledge.
Suggests that Intellexa can look over their shoulder & watch their sensitive targeting.
NEW: 🇨🇳Chinese hackers ran massive campaign by tricking Claude's agentic AI.
Vibe hacking ran 80-90% of the operation without humans.
Massive scale (1000s of reqs/sec).
Agents ran complex multi-step tasks, shepherded by a human.
Long predicted. Welcome to the new world.
Fascinating report by @AnthropicAI 1/
2/ The old cybersecurity pitch: unpatched systems are the threat.
The next generation concern might be unpatched cognition.
The attacker jailbroke the cognitive layer of @anthropic's Claude code, successfully convincing the system of false intent (that it was a security exercise)
3/ One of the key points in @AnthropicAI's report is just how limited the human time required was to run such a large automated campaign.
Obviously powerful stuff, highlighting the impact of orchestration.
And concerning for the #cybersecurity world for all sorts of reasons, ranging from attack scale, adaptability & cost reductions...