John Hammond is a cybersecurity researcher, educator and content creator. As part of the Adversary Tactics team at Huntress, John spends his days making hackers earn their access and helping tell the story. Previously, as a Department of Defense Cyber Training Academy instructor, he taught the Cyber Threat Emulation course, educating both civilian and military members on offensive Python, PowerShell, other scripting languages and the adversarial mindset. He has developed training material and information security challenges for events such as PicoCTF and competitions at DEFCON US. John speaks at security conferences such as BsidesNoVA, to students at colleges such as the US Naval Academy, and other online events including the SANS Holiday Hack Challenge/KringleCon. He is an online YouTube personality showcasing programming tutorials, CTF video walkthroughs and other cyber security content. John currently holds the following certifications: Security+, CEH, LFS, eJPT, eCPPT, PNPT, PCAP, OSWP, OSCP, OSCE, OSWE, OSEP, and OSED (OSCE(3)).

Tracking down a rogue Windows service for webshell persistence -- just a teeny weeny PowerShell HTTP server wrapped with NSSM, showcased with Wazuh and their sweet new 4.14 release with visibility on IT hygiene 😎 Video: https://lnkd.in/ggUcKMFF 

Huge thanks to Wazuh for sponsoring this video and their continued support of the channel! Try Wazuh completely for free, and check your IT Hygiene with an open-source SIEM and XDR platform! https://jh.live/wazuh

John Hammond

John Hammond is a cybersecurity researcher, educator and content creator. As part of the Threat Operations team at Huntress, John spends his days making hackers earn their access and helping tell the story. Previously, as a Department of Defense Cyber Training Academy instructor, he taught the Cyber Threat Emulation course, educating both civilian and military members on offensive Python, PowerShell, other scripting languages and the adversarial mindset. He has developed training material and information security challenges for events such as PicoCTF and competitions at DEFCON US. John speaks at security conferences such as BsidesNoVA, to students at colleges such as the US Naval Academy, and other online events including the SANS Holiday Hack Challenge/KringleCon. He is an online YouTube personality showcasing programming tutorials, CTF video walkthroughs and other cyber security content. John currently holds the following certifications: Security+, CEH, LFS, eJPT, eCPPT, PNPT, PCAP, OSWP, OSCP, OSCE, OSWE, OSEP, and OSED (OSCE(3)).

Check out the work I do here:
📺 https://j-h.io/youtube
🌎Follow me! ➡ https://j-h.io/discord ↔ https://j-h.io/twitter ↔ https://j-h.io/linkedin ↔ https://j-h.io/instagram ↔ https://j-h.io/tiktok
❤️ Support my YouTube Channel ➡ https://j-h.io/patreon ↔ https://j-h.io/paypal ↔ https://j-h.io/buymeacoffee 

Affiliates for free or discounted learning:
🖥️ Zero-Point Security ➡ Certified Red Team Operator https://j-h.io/crto
💻Zero-Point Security ➡ C2 Development with C# https://j-h.io/c2dev
👨🏻‍💻7aSecurity ➡ Hacking Courses & Pentesting https://j-h.io/7asecurity
📗Humble Bundle ➡ https://j-h.io/humblebundle

📧Contact me! (I may be very slow to respond or completely unable to)
🤝Sponsorship Inquiries ➡ https://j-h.io/sponsorship
🚩CTF Hosting Requests ➡ https://j-h.io/ctf
🎤 Speaking Requests ➡ https://j-h.io/speaking
💥 Malware Submission ➡ https://j-h.io/malware
❓ Everything Else ➡ https://j-h.io/etc

Wazuh

Cybersecurity Researcher | jh.live/training & jh.live/newsletter

Gerardo David Caceres Fleitas

In case you missed it, I took a look at the previous NPM package attack -- the one everyone was screaming about LARGEST SUPPLY CHAIN HACK IN HISTORY ZOMG!! ... with little impact and a couple crypto bucks 🤪

Here’s a snippet, you can catch the full video on YouTube! https://lnkd.in/ga6xwtmC

Supreeth Gori Padmanabhaiah

Walking through a PowerShell keylogger, which uses some inline C# to snag Win32 API functions from user32.dll, and funnels back keys and system info to a Tor onion address -- a nifty little challenge from LetsDefend (now part of Hack The Box 🔥) Video: https://lnkd.in/gsv3cXky 

Big thanks to LetsDefend for sponsoring this video and their continued support of the channel! Snag their Black Friday discounts and you can use code JOHN55 for 55% off 😁https://jh.live/letsdefend

Uncovered screen recordings from threat actors! 👀 Real footage of cybercriminals using anti-detect browsers and infostealer malware logs for session hijacking, and another using GraphSpy to read their Entra ID victim's emails in Outlook! 💀 Video: https://lnkd.in/gvrkeWzc 

Big thanks to Flare for sponsoring this video and their continued support of the channel! Get the new Entra ID integration for Identity Exposure Management to keep your business accounts protected with Flare! Try a free trial and see what info is out there: https://jh.live/flare

Flare

Flattered to help start the party for the Advent of Cyber Day 02 task from TryHackMe -- walking through today's challenge using the Social Engineer Toolkit to send a phishing email and snag passwords with a simple Python HTTP server! Video: youtu.be/w8O8FcRgDXU

Big thanks to TryHackMe for their continued support of the channel! You can jump into the Advent of Cyber 2025 event right now, it is free to play and anyone can join to level up their cybersecurity skills with a new task every day! https://jh.live/aoc2025

TryHackMe

Philippa Burgess

Over my Thanksgiving break I vibecoded an MCP server for OBS 😅 Saves only a couple clicks but then I could just say "start recording" ... and still have the potential to hook it up to a bigger agentic workflow! 😜 Honestly I am really seeing the power of MCP servers, it is a sweet tool to connect LLMs to tools and data -- but as with everything, it's another thing to consider the security implications for.
  
I've been flipping through a fancy new cheatsheet from Wiz on the best practices for MCP servers -- things like enforcing least privilege, locking down supply chain spooks, and keeping a human in the loop when you can. I'm gonna keep poking at MCP stuff because it's fun, but if you're using it in a real production environment, take a look at some of these tips! https://jh.live/wizmcp

Full length reverse engineering with Invoke RE! Showcasing new iterations of the "Scavenger" malware, or what we saw as "ExoTickler" previously as a fake City Skylines 2 video game mod, now w/ more crypto/creds stealing and C2. Binary Ninja, x64dbg & more: https://lnkd.in/gyBbUvwR

Huge thanks to Invoke RE Joshua R. Cedric Brisson for all their hard work and analysis here, and for joining me to show it all in this video!

Invoke RE

Senior SOC Analyst & Technical Lead @ Coveo

Charles Lucas

Beginner Blue Team Training! Just Hacking Training livestream on December 5, 2025 at 1pm ET/10am PT. https://justhacking.com

Hacking Twitch Chat 😎 L3TH4L_P4ND4 shows me what looks like template injection or unsanitized variable expansion with StreamElements, then leverages Nightbot to mod yourself, ban accounts, change livestream settings or many more hijinks 😜 Video: https://lnkd.in/gPtvZ6Em

Infostealer malware logs -- maybe an unconventional threat intel source, but Estelle Ruellan shows me her sweet research using LLMs to analyze stealer logs at scale:
- How did a victim get infected?
- Can we uncover a threat actor when they infect themselves? and more.
Video: https://lnkd.in/egaSQaDw

Big thanks to Flare for sponsoring this video and their continued support of the channel! Track data on the dark web and manage threat intelligence for your exposed attack surface with Flare -- try a free trial and see what info is out there: https://jh.live/flare

Walking through the Advent of Cyber "Prep Track" from TryHackMe! Some warmup tasks before the real free event kicks off December 1 running through December 24 -- we start the party with password security, insecure defaults, log analysis and more. Video:
https://lnkd.in/gapdBrtR 

Big thanks to TryHackMe for sponsoring this video and their continued support of the channel! Their Black Friday deal is TryHackMe's best discount: 40% off an annual subscription, you can use code JOHNBF and get ready for the Advent of Cyber! https://jh.live/aoc25

I'm a huge fan of proactive detection, and strategically placed canaries can be a core part of that... Tracebit has been showing me some super cool stuff all included with their free Community Edition! It can help put tripwires in your endpoints, web browser, email inbox, even your password manager, browser and more 👀 Honestly I'm stoked to see security canary technology and even the beginnings of cyber deception made to be more accessible to security teams -- those are the highest fidelity indicators and definitive proof that "there's a bad actor there!"

That 'assume breach' mentality always tends to ring true; and Tracebit makes canary deployment all throughout your stack super easy and centralized. Check out everything you can do with their free Community Edition! https://jh.live/tracebit

rambled about react: https://lnkd.in/gXhk4JhV

I got to chat with Matt Fredrikson, CEO over at Gray Swan AI, to learn more about the awesome stuff that he and his team are up to! We get into the tactical side of AI security: mapping out new vulnerability classes like prompt injection and jailbreaks, how strange suffixes can bypass guardrails across models, and how they are turning that research into real-world tooling and the Gray Swan Arena 😎 It's an open platform where you can red team live AI deployments, earn bounties, and sharpen your AI red teaming skills. Super cool stuff -- check'em out! https://jh.live/grayswan

Yapping about the GlassWorm supply chain malware campaign and the neato tricks it uses with "Invisible Unicode" characters -- essentially whitespace steganography, showcasing the Hangul Filler, zero-width space, & Private Use Area characters 🤯 Video: https://lnkd.in/gQafJnGE 

Big thanks to Flare for sponsoring this video and their continued support of the channel! Track data on the dark web and manage threat intelligence for your exposed attack surface with Flare -- try a free trial and see what info is out there: https://jh.live/flare

Okay, HackingHub is in a giving mood for the holiday season -- discounts still live and they are doing ANOTHER giveaway with this post for their: 
1. Hacker's Arsenal: https://lnkd.in/g63sAi2y
2. Bug Bounty Essentials: https://lnkd.in/gf7rBA2W
Same gimmick, comment + repost plz, NahamSec messaging winners Monday 12/1! 🦃🎅🚀

taplio

John Hammond's Linkedin Analytics

John Hammond

Performance ScoreJohn Hammond's LinkedIn Performance

What is John talking about?

John Hammond's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}John Hammond's Linkedin Analytics

John Hammond

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}John Hammond's LinkedIn Performance

What is John talking about?

John Hammond's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

John Hammond's Linkedin Analytics

Performance ScoreJohn Hammond's LinkedIn Performance

John Hammond's Best Posts (last 30 days)