Claude Code Opus 5.5 caught three strangers inside my Netflix, HBO Max and Spotify. Warsaw, Istanbul, Lagos. they'd burned through 40 hours of my stuff in two months and the Lagos one was 5 minutes from finishing a doc i'd been saving. the TV tipped me off. Netflix opened on a Turkish crime drama dubbed into Polish. the red on the logo looked off, warmer than usual. told Opus to pull auth logs from everything with a card on file. Netflix, HBO Max, Prime, Apple TV, YouTube Premium, Spotify. last 30 days. flag anything that isn't mine. four seconds later: Netflix → 3 sessions. Prague (me), Istanbul (?), Warsaw (?) HBO Max → 2 sessions. Prague (me), Lagos (?) Prime Video → clean Apple TV → clean Spotify Family → 4 members. i added 2. Warsaw was watching the Turkish drama right then. Istanbul had finished a second season i never started. Lagos had the Mariupol documentary paused at 42:11. how they got in: a Czech VPN provider dumped credentials in August. my Netflix password was in there. i'd rotated the bank one that week. not Netflix. device fingerprints: attacker 1 → Windows 11, pl-PL panel, Warsaw residential IP attacker 2 → Android 14 TV box, tr-TR, Istanbul attacker 3 → macOS 14, en-NG, Lagos mobile Spotify was the weird one. one of the two strangers i hadn't added had been building a jazz playlist for 6 months. soft stuff. the kind you put on at 4am when you can't sleep. told Opus to kick everyone. rotate every password. 2FA where it exists. fresh recovery emails on an alias i've never used. the sessions dropped one by one. the TV went dark, came back on the Netflix sign-in screen like we'd never met. set a cron. same check every Sunday. wake me only if there's a stranger. three strangers. two months. 40 hours of my taste in things. one jazz playlist i almost kept. if you've reused a Netflix password from 2022, run the check tonight. the Lagos guy had 5 minutes left.

Claude Code caught spyware on my 18 y/o sister's phone. Been running for 10 weeks before we noticed Her phone kept dying by 2pm. Pocket-warm with the screen off. She figured it was just worn out What tipped her off was that people kept knowing where she'd been. Not guessing, knowing Plugged the phone into my laptop, opened a terminal, gave Claude Opus 5.5 a single prompt: scan every running process, hidden ones included, flag anything she didn't install herself Under 2 minutes: → 63 processes alive → 60 clean → 2 old games still pinging her location in the background → 1 app named "Device Health", no icon anywhere, not in any store What "Device Health" was holding: → accessibility service, read everything on her screen → full photo and file access → mic, location, every SMS → device admin, so she physically couldn't uninstall it → scheduled upload every 15 minutes, 3am included Then I had Opus tear the app apart Decompiled in 4 minutes. What was inside: → every new photo copied and shipped out within 60 seconds → full gallery already exfiltrated, 2,300+ photos gone → keylogger catching every keystroke → screenshots triggered the moment she opened Instagram or her bank → GPS written to a log every 5 minutes Zipped and shipped to one server, 3 times per hour Still queued when we caught it: 847 screenshots, 112 fresh photos Opus pulled the receiver details: reports to → +1 (415) *** **72 carrier → T-Mobile US last ping → 40.7**, -73.9** · 2 min ago This wasn't a system app. Someone put it there by hand. She doesn't know who. Doesn't know when We archived everything the app had recorded, handed it off to people who do this for a living, then nuked it, rotated every password, turned on 2FA across the board Battery went from dead at 2pm to 40% by 10pm Your 3-minute check tonight: battery → if something drains with the screen off, that's a signal photos → only your camera and gallery apps need "all photos" accessibility → any app in there you can't explain shouldn't be device admin → "Find My Device" is the only one that belongs no-name apps → missing icon + "system", "health", "sync" in the name → open it Found something? Don't tap delete yet. Screenshot the permissions, the storage, the install date. Then remove it and rotate passwords from a different device Save this. Check your phone tonight. Then check your family's Prompt below ↓

HIDDEN GEM ON GITHUB 📈 mixelpixx/Konnect +228 stars in 24h ⭐ 1.2k total ⭐ claude can design circuit boards now. konnect is a kicad 10 plugin that gives your AI 228 tools over MCP it places parts and wires the schematic, lays out and routes the PCB in real time, runs ERC and DRC checks, and exports gerbers, BOM and pick-and-place files ready for the fab it even searches a local catalog of 2.5M JLCPCB parts for stuff that's actually in stock, and starts from reference circuits like USB-C, buck converters and STM32 smart detail: loading all 228 tools would eat ~23K tokens, so it starts with a ~2K starter kit and pulls the rest on demand single rust binary, ~9 MB download. still beta, so check every board before you order it bookmark it if you've ever spent a weekend routing traces by hand

REPO OF THE DAY 📈 NationalSecurityAgency/ghidra the NSA's own reverse engineering tool, free and open source since 2019 +1,366 stars in 24h ⭐ 88.3k total ⭐ why it's trending again: rea. the agent tool that blew up this week uses ghidra under the hood to read .exe and mac apps. everyone installing rea ends up installing this what you get: disassembler, decompiler, graphs and scripting in java or python. runs on windows, mac and linux, apache 2.0 one thing the readme says upfront: some older versions have known vulnerabilities, check their security advisories and stay updated funny timeline. a tool built for nsa analysts is now an engine for your coding agent bookmark it if rea is next on your list

OVERHYPED OR ACTUALLY USEFUL? 📈 mksglu/context-mode +902 stars in 24h ⭐ 29.6k total ⭐ claim: 98% less junk in your agent's context. my take: useful, if you read the fine print the problem is real. a playwright snapshot is 56 KB, 20 github issues are 59 KB. half an hour of tool calls and your context is gone context-mode runs those tools in a sandbox and only hands the model the result. their benchmarks: 315 KB of raw output down to 5.4 KB per session the best idea in it costs nothing: make the agent write a script that counts the files and prints one line, instead of reading 47 files into context fine print - the 98% is their own benchmark on tool output, not your whole token bill - license is Elastic 2.0. source-available, not open source. you can't resell it as a hosted service works with claude code, codex, cursor, gemini cli and a dozen more bookmark it if your agent sessions keep dying at compaction

FREE WAR ROOM ON GITHUB 📈 PALANTIR sells governments war rooms for MILLIONS a year. elie habib built one, open-sourced it, and it's sitting at 88k stars koala73/worldmonitor 88.3k stars ⭐ 13.5k forks ⭐ 3d globe, live news from around the world summarized by ai, a stability score for 31 countries, stocks, commodities and crypto in one panel it went viral in july. since then it got an MCP server, a CLI and python and ruby sdks so your agent can pull the same data now. worldmonitor risk IR returns iran's risk score right in the terminal local ai runs through ollama, no keys for that part. some data sources and MCP calls still need an api key, the readme says it upfront desktop app for mac, windows and linux. AGPL, free to self-host a dashboard is cool. an api your agent can query is the useful part bookmark it for the next time the news goes crazy