mxschmitt

Campaign simple-1k-20260613-v9 — Analysis

Campaign: 789 tasks (simple complexity, 3-5 steps) across 3 personas (office_worker, student, developer) Infrastructure: 500 c8i.2xlarge Docker fleet (Win11 via dockur), golden disk v9, overlay v2

Results Summary

Metric	Value
Sessions ran	770

mxschmitt

Running Clubs Berlin vs Running FOMO — Club Comparison

Overview

• runningclubsberlin.de has ~47 clubs listed
• Running FOMO has 102 clubs listed
• We already share 38 clubs in common
• They have 10 clubs we don't have

---

mxschmitt

DCV Cursor Capture Investigation

RECOMMENDED PATH FORWARD: Patch ffmpeg gdigrab (PROVEN WORKING)

The Fix

Patch ffmpeg's libavdevice/gdigrab.c:paint_mouse_pointer() to accept CURSOR_SUPPRESSED and use GetCursor() + AttachThreadInput() for the cursor handle. This is proven working — we built and tested a patched ffmpeg on a headless EC2 instance (2026-05-22).

Results:

• Baseline (unpatched): ffmpeg gdigrab -draw_mouse 1 → 131KB video, NO cursor visible

mxschmitt

marp	true
theme	default
paginate	true

Nova Act Realtime Pod

First update

An agent that keeps up with you. Sees what you see. Adjusts when you adjust.

mxschmitt

name	copilot-review
description	Review GitHub Copilot PR comments, evaluate and apply valid ones, resolve all threads
argument-hint	[PR-number-or-url]
disable-model-invocation	true
allowed-tools	Bash(gh *), Read, Edit, Write, Grep, Glob, Agent

Review Copilot PR Comments

mxschmitt

Cursor Cloud Agent — Architecture & Internals

Reverse-engineered from a live Cursor Cloud Agent session running claude-4.6-opus-high-thinking. All findings are based on runtime inspection of /exec-daemon/index.js (15MB webpack bundle, 379K lines), process inspection, network analysis, and system introspection. Date: February 25, 2026.

---

Table of Contents

mxschmitt

Odyssey Stealer (ClickFix Campaign) - Malware Investigation

Summary

This repository contains an analysis of a macOS infostealer delivered via a ClickFix social engineering attack hosted on testdino.com. The malware is an instance of Odyssey Stealer (a rebrand of Poseidon Stealer, itself a fork of AMOS/Atomic Stealer) -- a sophisticated macOS credential and cryptocurrency theft tool distributed as Malware-as-a-Service (MaaS) by a Russian-speaking threat actor known as "Rodrigo."

The victim was tricked into pasting a malicious command into their macOS Terminal through a fake CAPTCHA verification page.

---

mxschmitt

    - name: Download
      run: Invoke-WebRequest https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-windows-amd64.zip -OutFile ngrok.zip
    - name: Extract
      run: Expand-Archive ngrok.zip
    - name: Auth
      run: .\ngrok\ngrok.exe authtoken $Env:NGROK_AUTH_TOKEN
      env:
        NGROK_AUTH_TOKEN: ...
    - name: Enable TS
      run: Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0

mxschmitt

.NET:

• no cache hit (probably because we sign and its then different, or because we do a local install)
• we still have the 600 MB cache folder (which never gets used)

Python:

• no cache hit
• 0MB cache (probably local install does not end up in the cache)

Java:

mxschmitt

Get your list of versions from here: https://nodejs.org/download/nightly/

v20.0.0-nightly20221021eb32a8443a/                 21-Oct-2022 07:30                   - good
v20.0.0-nightly20221031e43ecd5fec/                 31-Oct-2022 07:30                   -
v20.0.0-nightly20221101590cf569fe/                 01-Nov-2022 07:00                   -
v20.0.0-nightly20221111916af4ef2d/                 11-Nov-2022 06:30                   -
v20.0.0-nightly20221121abadaca982/                 22-Nov-2022 19:00                   -
v20.0.0-nightly202212013bed5f11e0/                 01-Dec-2022 07:00                   -
v20.0.0-nightly20221202cc2732d764/                 05-Dec-2022 17:00                   -