Co-Founder @webamon_search, Founder @PIntelligenceUK, Training @kasescenarios, #MontyTheCyberCorgi. Webinars/Exec @OSINT_Community, Creator of the OSINT Portal
United Kingdom
Joined September 2016
- Tweets2.1K
- Following1.2K
- Followers2.2K
- Likes6.8K
Pinned Tweet
Now that my book #CyberThreatIntelligence is out, if you're so inclined here's an Amazon affiliate link for purchase: amazon.com/gp/product/B09C7V… - Any and all reviews gratefully received!
Aaron Roberts retweeted
The recording device just escaped its sandbox
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
Two possible findings from @webamon_search that may be related: hydra3[.]xyz/login (captured 6 October) and cracksword[.]com/login (9 October).
Each displayed a different product name, but retained the same description and console-title suffix found in the source.
intel.webamon.com
Aaron Roberts retweeted
We're on tour again 🚗 ... come and see us at @PoliceDigital #NPCCSummit2026 in Liverpool next week!
Aaron Roberts retweeted
Listen to what people had to say about the @OSINT_Community Global #OSINT Conference
Aaron Roberts retweeted
🌍 Global OSINT Conference 2026
Investigators, police, journalists and intelligence professionals came together in London to share skills and build connections.
Thank you to everyone who attended!
Watch why the conference matters 👇
Aaron Roberts retweeted
🇬🇧 The UK is the capital of OSINT. We’re only getting started.
Our first Global OSINT Conference in London was a huge success, with CIA, NCA and DHS experience on stage.
British talent. Global expertise.
Next year: bigger and better.
@OSINT_Community x @PoliceDigital
The awesome @cqcore opening up one of the rooms here at the Global OSINT Conference.
Aaron Roberts retweeted
⏳ Just 24 hours until the Global OSINT Conference!
A day of OSINT, fresh ideas and meeting the people behind the investigations.
See you tomorrow! 🙌
🚨 The Global OSINT Conference 2026 is coming to London on 5 October.
A full day bringing together leaders from intelligence, policing, national security, journalism and technology.
Hosted by @nattyfried and Lindsay Whyte of the @OSINT_Community 🧵👇
Aaron Roberts retweeted
Worse than China, and more dangerous because people in China are aware. You know what you’re getting in China.
In the West, people are fighting for surveillance under the guise of child safety, public safety, anti-fraud, anti-immigration, AI dangers, and my personal favourite, convenience. People are adding ChatGPT to a service that’s supposed to be protected by ent to end encryption, and security professionals working for companies like Palo Alto Networks say it’s no different to taking screen shots of private messages.
Surveillance is being normalised. Predictive policing will be normalised soon if we keep acting like sheep.
Naomi Brockwell just warned that the West has no idea how close we are to becoming a surveillance state like China.
And we’ve forgotten that privacy is a pillar of a free society.
“It is privacy that protects every self-correcting mechanism we have.”
“Whistleblowers.”
“Investigative journalists.”
“Protest movements.”
“Opposition parties.”
“These entities can’t exist without the protection of privacy.”
“When that’s gone, it is going to be so difficult to get it back.”
“We’ve had people in the U.K., in the United States, in Australia, look at what’s going on in China… saying, ‘This is great.’”
“‘This is a great system for control that can make society better.’”
“It is so dystopian.”
“We need to be looking at things like that with a giant red flag and fighting it with everything we’ve got.”
“Once you get over that panopticon surveillance precipice, it is so difficult to reclaim your freedoms.”
@naomibrockwell
A single fingerprint is often all it takes to track malicious websites. Something Webamon does as standard.
This also allows the malicious campaigns to be tracked and followed with ease. And one of my favourite aspects is turning it around and using it for supply-chain or your own system monitoring as well.
And every day we identify and find something new!
Another great community blog submission from our community researchers.
This one looks at YouTube videos for cheats for PC games, and of course they're all very, very legitimate...
If you're into infostealers and the like, another great threat intel read!
"Turn off your antivirus." If a download tells you that, it's not a setting. It's the attack.
Project Ghostlight looked at one simple question: are YouTube crack-and-cheat videos still pushing malware in 2026? Across 24 cases with 583,000+ combined views, the same signals kept surfacing:
🔹 20 of 24 told viewers to disable antivirus before running the file
🔹 21 of 24 hid the payload behind an archive password
🔹 18 of 24 channels whose content didn't match what they were serving
🔹 Delivery hopped YouTube > Community post > external host > password-gated archive > "disable AV" > run
The analyzed loader was a credential, wallet and messaging stealer with remote-access capability. Webamon showed the infrastructure still live in late August, and caught nexus-mods[.]net navigating to nexus-mods[.]biz, still serving Nexus-Mods-branded content.
The honest limit: this is a recurring pattern, not proof of one operator or one malware family. The risk is repeated exposure, and it's still out there.
If a crack, cheat, mod or unofficial installer asks you to turn off your security software, don't run it. Report it.
Full write-up, delivery chain and IOCs 👇
I'm on a bit of a European tour over the next couple of weeks. - Munich with @MaltegoHQ, then @BSidesChelt, @OSINT_Community Conference then Dublin for Rebase.
Talking all things @webamon_search to whoever wants to listen. Any of my esteemed nerds attending any of them?
One page to eight historical captures across five hostnames.
In this 60-second Webamon demo, I inspect a MetaMask-branded email form, then pivot on an exact JavaScript hash to find the related scans.
Our Research Lab has five seats and is cheaper than a conference ticket! DM me for a walkthrough or if you want to discuss how we can help you find brand impersonations.
Claude Sonnet 5.5 put through the NetWatch AI threat hunting benchmark, scoring 88.75/100.
Sonnet 5.5 narrowly beats Opus 5.5 and ties Opus 4.8 in scoring.
GPT-6 Sol remains the strongest model tested by the NetWatch benchmark to date.
Aaron Roberts retweeted
This is a gross violation of internet privacy and free expression in the UK.
Far from protecting children, it will force adults to tie their real identities to their online activity, with no protection or recourse from government overreach.
🚨NEWS: The UK's under-16 social media ban will come into effect in March 2027, the Government confirms
A social media ban will not keep children safe but it would encourage the Government to assert more control over how we use the internet.
It would introduce digital ID by the backdoor, infringing on all of our rights & freedoms.
Read ⤵️
lbc.co.uk/article/social-med…
Opus 5.5 has now run through the NetWatch autonomous threat-hunting benchmark. Achieving an overall 87.81/100. Strong model, benchmarked within a margin of error of Opus 4.8
Of 43 local and cloud models now tested, GPT-6 Sol is the leader, followed by Grok 4.7
Local-wise, Qwen3.8:27b is a beast and viable. Although a full hunt with that took 7 hours total on my MacBook. So viability on hardware with more/less capability would obviously factor in.
Hunts are done using Webamon. Each model receives the same brief and is scored based on how it performs that brief. It's not super scientific; it's a bit of fun.
But it is interesting to see the differences and how viable open-weight models are when using something like Ollama Cloud.
Not to brag lads but my book royalties for the last six months amount to £45 after tax.
The Aston Martin fund is going to take a while...
We have yet another new leader in the NetWatch AI threat hunting benchmark!! GPT-6 Sol storms into the lead, meaning Grok 4.7 was the boss for all of a day.
Opus 5.5 as soon as I can get to it!
GPT-6 Luna did not perform very well in the test, failing to run searches correctly.
One thing that surprises me is how much difference there can be between the same ‘family’ of models. Like here Luna was one of the worst tested yet Sol is better than Astra.
I think models like Astra and Fable might struggle with this test because they’re too clever. But I’m not sure in all honesty.
Something to look at.