Matt Johansen (@mattjay) / X

Matt Johansen

47.4K posts

Matt Johansen

@mattjay

Founder of @vuln_u | Long Island elder emo surviving in ATX | AI and Cybersecurity news from an 18yr industry vet

Join 35k+ subscribers:

Joined June 2008

Pinned
Matt Johansen
@mattjay
Mar 3, 2023
🚨 Exciting thing🚨 I'm getting back to my content creation roots. I've missed blogging, podcasting, and community engagement from back before I worked for big companies with scary PR teams. So... I'm launching a newsletter called Vulnerable U.
vulnu.com
Vulnerable U
Infosec's favorite weekly newsletter for news, tools, and tips with 34,000+ CISOs, founders, change-makers, and straight up hackers.
202K
Matt Johansen
@mattjay
Apr 18, 2025
🧵 THREAD: A federal whistleblower just dropped one of the most disturbing cybersecurity disclosures I’ve ever read. He's saying DOGE came in, data went out, and Russians started attempting logins with new valid DOGE passwords Media's coverage wasn't detailed enough so I dug
9.9M
Matt Johansen
@mattjay
Oct 6, 2023
🚨BREAKING: Genetics firm 23andMe confirms user data theft in a credential stuffing attack. The hackers released 1 million lines of data targeting Ashkenazi Jews.
Readers added context they thought people might want to knowReaders added context
More context: the company’s servers were not breached. The attackers logged in to user accounts that had simple or reused passwords, and leveraged the “DNA relatives” feature to gain more information. “The information does not appear to include actual, raw genetic data.” wired.com/story/23andme-…
Context is written by people who use X, and appears when rated helpful by others. Find out more.
5.8M
Matt Johansen
@mattjay
Oct 5, 2024
So U.S. uses backdoors in it's own Internet providers to spy on it's citizens. China says "don't mind if we do" and backdoors the backdoors. They sat for months undetected on the U.S. wiretap system for Verizon, AT&T, and more...
1.2M
Matt Johansen
@mattjay
May 28, 2024
The DoJ just busted a massive scam involving North Korean IT workers infiltrating major US companies. They had some help in the US and were posing as remote freelancers to siphon off money and sensitive info. Holy crap, here's what we know:
3.2M
Matt Johansen
@mattjay
Mar 25, 2025
Gentle parenting your way through leaking military plans in a group chat.
00:00
296K
Matt Johansen
@mattjay
Jul 27, 2023
🚨 Woah. An intentional backdoor discovered in encrypted radio comms used globally for over 25 years. Buckle up!
3.1M
Matt Johansen
@mattjay
Jul 30, 2024
Best cosplay of 2024?
582K
Matt Johansen
@mattjay
Apr 18, 2025
Replying to @mattjay
Who’s the whistleblower? Daniel Berulis — a senior DevSecOps architect at the National Labor Relations Board (NLRB), formerly with TS/SCI clearance. He just told Congress the Department of Government Efficiency (DOGE) pulled off a covert cyber op inside a federal agency.
820K
Matt Johansen
@mattjay
Apr 18, 2025
Replying to @mattjay
The most daming claim in this statement IMO: Within 15 minutes of DOGE accounts being created… Attackers in Russia tried logging in using those new creds. Correct usernames and passwords. 2 options here. The DOGE device was hacked. And I don't think I need to explain the 2nd.
555K
Matt Johansen
@mattjay
Apr 18, 2025
Replying to @mattjay
DOGE demanded root access. Not auditor access. Not admin. They were given “tenant owner” privileges in Azure — full control over the NLRB’s cloud, above the CIO himself. This is never supposed to happen.
556K
Matt Johansen
@mattjay
Apr 18, 2025
Replying to @mattjay
They disabled the logs. Berulis says DOGE demanded account creation with no recordkeeping. They even ordered security controls bypassed and disabled tools like network watcher so their actions wouldn’t be logged.
506K
Matt Johansen
@mattjay
Jun 23, 2022
Imagine being in infosec and proudly announcing all the false positives you blocked.
TSA Northeast
@TSA_Northeast
Jun 22, 2022
Display of oversized liquids, gels and aerosols that travelers had in their carry-on bags at the ⁦@SyracuseAirport⁩ @TSA Checkpoint in a 3-day span. The limit for liquids through a checkpoint is 3.4 oz.
Matt Johansen
@mattjay
Feb 13, 2024
Turns out the parent company of Temu has a history of publishing malware into their Android apps Let's dig in:
1.8M