Rachel Tobac
@racheltobac.bsky.social
Hacker & CEO @SocialProofSec security awareness/social engineering training, videos, talks | 3X @DEFCON🥈 | Ex Chair @WISPorg | Ex @CISAgov Technical Advisory Council under Director Jen Easterly
The new “⚠️Seems like AI slop” button on LinkedIn is sending me into orbit lmao
my LI feed is basically just @lauriewired.bsky.social and @racheltobac.bsky.social because I thumbs down all the slop
That's not a lot of reflection to go on 🤯
Rachel Tobac@racheltobac.bsky.social · 2w agoWas curious if I could use AI (Graylark) to find coordinates of this house using just a *reflection in a keypad* of the surroundings. Well...it worked. YIKES. Daniel Heinen does not make this AI tool available to the public for this reason. youtube.com/shorts/Xzbvi...
This is scary; Start the cleanup 😆
Rachel Tobac@racheltobac.bsky.social · 2w agoWas curious if I could use AI (Graylark) to find coordinates of this house using just a *reflection in a keypad* of the surroundings. Well...it worked. YIKES. Daniel Heinen does not make this AI tool available to the public for this reason. youtube.com/shorts/Xzbvi...
Was curious if I could use AI (Graylark) to find coordinates of this house using just a *reflection in a keypad* of the surroundings. Well...it worked. YIKES. Daniel Heinen does not make this AI tool available to the public for this reason. youtube.com/shorts/Xzbvi...
Can AI geolocate using just reflections?!
YouTube video by SocialProof Security
youtube.com
This year WISP is sending 41 Scholars to @defcon.bsky.social / @blackhatevents.bsky.social to find their community, new skill, or next job! I just donated $1K to cover 1 scholar’s WISP support team, swag, events, community room, etc. Who’s matching me! wisporg.app.neoncrm.com/forms/wisphsc26
Doing an AMA style panel for our ContinuumCon opening keynote tomorrow! We need your questions to answer, drop them below! What do you want us to talk about? List anything you want to know more about below! Cc: @johnhammond.bsky.social @rekdt.com @jun34u.bsky.social continuumcon.com/schedule/
Schedule
ContinuumCon is the cybersecurity conference that never ends. It's a hands-on workshop and interactive lab environment that meets you where you are. Sessions range from foundational concepts to cuttin...
continuumcon.com
In the age of tech companies consistently doing shitty things, this is genuinely cool and a smart solution to stopping Scammers with RCS (meaning it's encrypted and private too)!
Rachel Tobac@racheltobac.bsky.social · 2mo agoWHOA Google let me know they saw my tweet last year & built a tool to defend against the exact call spoofing + AI voice clone attack! As of *today*, fake call detection on Android alerts when someone is impersonating your contact. Thread and demo below:
WHOA Google let me know they saw my tweet last year & built a tool to defend against the exact call spoofing + AI voice clone attack! As of *today*, fake call detection on Android alerts when someone is impersonating your contact. Thread and demo below:
I used deepfakes & injection attacks to hack an identity verification tool used for remote workforce, helpdesk, & onboarding…until they updated the tool to catch me. Thank you @incode.bsky.social for having me hack you 110+ times to find the latest vulns and fix them🤖🤘 Full vid: youtu.be/pAegYkwWIgE
"If there's one thing I could tell people to do, it would be to use a password manager. Do not reuse old passwords." @racheltobac.bsky.social, on how to protect yourselves from hacks
Whoa, Instructure (who owns Canvas) says they came to an agreement with the cyber criminals (typically this means a ransom was paid) in exchange for the stolen data being deleted instead of leaked and criminals ceasing all extortion requests from customers. Huge development.
Rachel Tobac@racheltobac.bsky.social · 3mo agoCanvas is hacked and stressing out 230+ million students, teachers and staff during finals. What does this mean and how do we stay safe? What are the next steps for the 8,800 affected schools during finals. Answered below in my video:
Canvas is hacked and stressing out 230+ million students, teachers and staff during finals. What does this mean and how do we stay safe? What are the next steps for the 8,800 affected schools during finals. Answered below in my video:
My dad told me if I'm the smartest person in a room, then I'm in the wrong room. For the @rapid7.com Global #Cybersecurity Summit I'll be in the right room as I'll be joined by @rajsamani.bsky.social @racheltobac.bsky.social & @grahamcluley.com for the Keynote Panel. Join us rapid7.brighttalk.com
Rapid7 2026 Global Cybersecurity Summit | Virtual Event
Join Rapid7’s 2026 Global Cybersecurity Summit, a two-day virtual event on preemptive security operations, cyber resilience, MDR, and AI-driven defense.
rapid7.brighttalk.com
Have you received a party invite that turned out to be fake (a scam!) in the last 6 months?! I just broke down how this scam works for the @nytimes.com, dive into the 2 distinct paths this scam follows, how to catch it, and how to reduce its impact if you do click: www.nytimes.com/2026/04/23/s...
There’s a New Phishing Scam: Fake Invitations
nytimes.com
Want my thoughts on Anthropic's Mythos risk vs hype, how I use AI to bypass identity verification systems now, & more? Tune in for my Rapid7's 2026 Global Cybersecurity Summit keynote panel 5/12 with Graham Cluley, Raj Samani, Brian Honan! Join me here: rapid7.brighttalk.com
I'm speaking at Rapid7's 2026 Global Cybersecurity Summit, May 12-13. Come hear me chat about how modern attacks actually start, and the reality of running a SOC in 2026 - alongside @racheltobac.bsky.social, @rajsamani.bsky.social, and @brianhonan.bsky.social rapid7.brighttalk.com?utm_source=r...
Rapid7 2026 Global Cybersecurity Summit | Virtual Event
Join Rapid7’s 2026 Global Cybersecurity Summit, a two-day virtual event on preemptive security operations, cyber resilience, MDR, and AI-driven defense.
rapid7.brighttalk.com
Going to this UN thing in Vienna with my team and the only name I recognize on the program is @RachelTobac (which is a good sign! So much to learn about scams!)
I watch my company’s security awareness training just because the speaker is @racheltobac.bsky.social
Signal will never message you like this. If you get a message like this, SOMEONE IS TRYING TO HACK YOUR SIGNAL. DO NOT GIVE THEM THAT CODE.
WARNING, fellow journalists: As @nicoschmidt.io explains, attackers are trying to hijack reporters' Signal accounts by tricking people into handing over their 2FA codes. www.linkedin.com/posts/nicosc...
If you’re an activist, journalist, exec, or have a high threat model for any other reason, I do recommend using all tools to protect against spyware including Apple’s lockdown mode and WhatsApp’s new Strict Account Settings. Thanks WhatsApp for the partnership to get the word out to folks.
The repairable, customizable, build-it-yourself, physical webcam & mic kill switch, Linux compatible, port swappable @frame.work laptop has hit the SocialProof office 🤖🤘
Great work from @racheltobac.bsky.social, with @cnn.com: How the latest deepfake scam can cheat companies out of millions. Good one to share with your company, and with friends & loved ones. edition.cnn.com/2025/10/07/b... cc @craignewmark.bsky.social @pausetake9.bsky.social @gate15.bsky.social
How the latest deepfake scam can cheat companies out of millions | CNN Business
From CEOs to colleagues, deepfake technology can trick people into sending money, sharing passwords, or revealing sensitive information - all in seconds. CNN’s Clare Duffy met with ethical hacker and ...
edition.cnn.com
An totally entertaining, and informative interview with @racheltobac.bsky.social and Scammer Payback about hacking and handling your online privacy in the new epoch of AI. youtu.be/xEdZwLRJttQ?...
Social Engineer: YOU are Easier to Hack than your Computer
YouTube video by Scammer Payback
youtu.be
Episode 22: Social Engineering, Gas Mark 4, and AGAs with Rachel Tobac! @tib3rius.bsky.social & @swiftsecur.bsky.social are joined by @racheltobac.bsky.social to talk social engineering war stories...and more! Links below!