John Hammond analyzes a ClickFix payload that searches files in the Windows Firefox profiles directory, checks a numeric condition, copies a matching file to a temporary location named t.bat, and runs it without displaying it.
A prototype Minecraft mod visualizes files from open directories and moves samples toward MWDB for analysis. The stream shows sandbox and integration problems, including collected Bash history and an API key, while weighing persistent storage against disposable VMs.
A live stream develops a Minecraft security research interface, progressing from open-directory metadata browsing to a local VMware VM sandbox and a proposed guest-agent control plane for analyzing downloaded files.
The speakers discuss how unpatched internet-facing systems could become C2, mail-relay or staging infrastructure. They describe code execution from memory corruption, note lateral movement depends on network configuration, and urge patching.
Microsoft describes Edge features that let users block and report abusive notification prompts and automatically disable notification permissions when a notification leads to a suspicious site.
Speakers discuss plugin breakage risks when moving older PHP sites to version 8, urge patching before experimenting with an exploit, and warn that some sites may not return if upgrades are delayed.
The video demonstrates a Minecraft mod that explores open internet directories and displays file contents. Downloading samples for analysis is a future goal, but the creator says a separate sandbox is needed first.
The discussion describes two critical PHP bugs as memory-corruption flaws that can enable remote code execution and full system access. John Strand cites large exposure estimates but cautions that patch backports and version reporting may distort them.
A guest demonstrates how weakly protected HMI access, a software-PLC reverse shell and Modbus man-in-the-middle tampering can overflow a simulated water tower. The discussion recommends keeping PLCs off the public internet and separating OT from IT.
Ashish Rajan discusses securing AI agents through network isolation, configuration enforcement and deterministic evaluations, and previews Charlie, an open-source tool intended to help practitioners assess coding-agent settings.
The video demonstrates a Windows batch payload staged in browser cache and retrieved through a Run-dialog command. Network requests to cloudrecycled[.]com include the user agent, which may help determine which payload to serve.
John Hammond and Grey Noise founder Andrew Morris demonstrate Project Swarm, showing how users can deploy honeypot sensors, inspect exploit traffic, download packet captures and investigate suspicious scanning.
Just Hacking Training celebrates its second anniversary as John Hammond explains Huntress CTF's AI-assisted time trials, dynamic challenge variants and automation-focused scoring, alongside updates on hands-on security labs.
On Payload Podcast, Yarden Shafir discusses Windows protections intended to isolate AI agents, risks from shared user permissions, and where AI assistance can help security research and patch assessment.
The video reviews cybercrime-forum listings and research on uncensored AI tools, including reported phishing and infostealer workflows. It notes that some reported attacks still involved human-operated initial access and that legitimate security research also uses these
Shiny Hunters claimed to have compromised FBI systems and data. The host says a reviewed 5,000-line sample appears authentic but cannot verify the full dataset; the group demanded changes to an FBI report, and a PeopleSoft zero-day’s role remains uncertain.
A Just Hacking Training livestream introduces Crosswind Systems, an intentionally vulnerable practice site, and demonstrates basic web application reconnaissance using page source, search results and crawler directives.
A Payload Podcast discussion examines Microsoft's preview endpoint security platform, a proof of concept for collecting process events, and uses and limitations of AI in security research.
John Hammond analyzes a ClickFix lure on a compromised site impersonating Cloudflare Turnstile. It retrieves browser-specific batch payloads from cache, launches staged PowerShell/.NET code, and exfiltrates browser cookies and history.
John Hammond demonstrates a proof of concept that elevates a low-privilege Windows user to SYSTEM through Steam's client service. He traces the IPC and signed VDF mechanism and discusses the PoC's apparent AI-assisted development.
A Minecraft mod prototype uses Hunt.io data to represent open internet directories as in-game environments and files as creatures. The demonstration shows working host portals and file listings, alongside unresolved navigation and display bugs.
Brandon Keith demonstrates a Python training course for cybersecurity practitioners, covering unit testing, security data parsing and the risks of relying on unchecked AI-generated code.
The video recounts Team PCP’s cloud and software-supply-chain attacks and Flare’s OSINT investigation linking reused accounts and profile images to Reuben Thompson, whom the presenter identifies as the suspected leader and says was arrested.
The video follows development of a Minecraft mod that queries Hunt[.]io’s Attack Capture API for open-directory hosts and files. The data appears in-game, though its presentation and file retrieval still need work.
