journalist @correctiv_fakt @correctiv_orgㅣ@DowJones @WSJ alumㅣprev. work @dpa @LHreports @dwnews @guardian @WIRED othersㅣOSINT
Joined September 2014
- Tweets 3,437
- Following 3,255
- Followers 1,901
- Likes 6,000
181 Photos and videos
Pinned Tweet
New: We looked into the large-scale phishing campaign that's targeting Signal users and found digital evidence pointing to Russian involvement – and a connection to previous attacks in Ukraine and Moldova.
8
81
181
20,159
Max Bernhard | @mxbernhard.bsky.social retweeted
May 22
Thanks to @mxbernhard & Correctiv for picking this up blazingly fast! We built on their excellent investigation into the Neculiti Brothers and Stark Industries: correctiv.org/faktencheck/hi…
2
2
7
350
Max Bernhard | @mxbernhard.bsky.social retweeted
May 22
EU sanctions were supposed to shut down Russia’s favorite bulletproof hosting service, Stark Industries. Instead, it moved next door.
Proud & happy to share this story. Huge thanks to
@huibmodderkolk & every source who contributed, on or off the record. Lots more to say soon! volkskrant.nl/binnenland/how…
1
18
30
9,326
RT @correctiv_fakt: In den Niederlanden wurden zwei IT-Unternehmer verhaftet, weil diese gegen EU-Sanktionen verstoßen haben sollen. Im Fok…
31
Max Bernhard | @mxbernhard.bsky.social retweeted
In January, a phishing message arrived on my Signal account, supposedly from "Signal Support."
The unwise attack attempt, gave me a unique opportunity to peek inside this wide-scale phishing campaign targeting journalists and politicians.
I was target #13,730 in their database.
10
123
510
61,611
RT @correctiv_fakt: Vor einer Weile stießen wir auf #Tiktok auf ein auffälliges Profil: Eine junge Frau wirbt einerseits für ihr Profil auf…
55
.@derspiegel and others now report that the German government suspects Russia to be behind this espionage campaign, in line with our findings last month
spiegel.de/politik/deutschla…
New: We looked into the large-scale phishing campaign that's targeting Signal users and found digital evidence pointing to Russian involvement – and a connection to previous attacks in Ukraine and Moldova.
4
6
21
2,669
Max Bernhard | @mxbernhard.bsky.social retweeted
Since 28 February 2026, southern Lebanese villages close to the Blue Line have been systematically destroyed. CIR has analysed satellite imagery of 46 towns and villages to document the scale and pattern of what is happening on the ground. 1/5
[📽️: Detonation of residential homes in Naqoura, southern Lebanon at coordinates 33.1209, 35.1345 and 33.1208, 35.137. Source: X]
3
25
62
9,924
RT @correctiv_fakt: Ein Satellitenbild soll brennende Öl-Infrastruktur unter anderem in Saudi-Arabien und Kuwait zeigen. Doch die Aufnahme…
8
Max Bernhard | @mxbernhard.bsky.social retweeted
Mar 26
We are observing a targeted campaign delivering DarkSword RCE (GHOSTBLADE) via fake Atlantic Council "discussion invitation" emails.
IOCs:
siekeltd[.]com
escofiringbijou[.]com -- payload & C2
1
31
117
73,302
Max Bernhard | @mxbernhard.bsky.social retweeted
Mar 26
New: We looked at how Russia is remaking occupied territories in Ukraine, pouring hundreds of millions of dollars into roads, railways and ports to try and inexorably tie the region into their own, part of Putin's grand vision for so-called "Novorossiya" reuters.com/investigations/w…
1
7
13
500
Max Bernhard | @mxbernhard.bsky.social retweeted
New: We looked into the large-scale phishing campaign that's targeting Signal users and found digital evidence pointing to Russian involvement – and a connection to previous attacks in Ukraine and Moldova.
8
81
181
20,159
Max Bernhard | @mxbernhard.bsky.social retweeted
Mar 26
The US is making its offer of security guarantees for a peace deal conditional on Kyiv ceding all of Donbas to Russia, Zelenskiy told Reuters. Trump is applying pressure to Ukraine in an effort to bring a quick end to the four-year war, he said. reuters.com/business/aerospa…
2
2
5
301
New: We looked into the large-scale phishing campaign that's targeting Signal users and found digital evidence pointing to Russian involvement – and a connection to previous attacks in Ukraine and Moldova.
8
81
181
20,159
This tool was being advertised on Russian hacker forums for less than 700 USD. We also found evidence that it was used in previous phishing campaigns targeting users in Ukraine and Moldova.
1
1
13
641
Story with @alexejhock for @correctiv_org correctiv.org/en/fact-checki…
You can find a list of the domains and corresponding IPs we found here correctiv.org/wp-content/upl…
2
3
11
624
Max Bernhard | @mxbernhard.bsky.social retweeted
Mar 10
“Made in USA” and Department of Defense codes: new photos of weapon debris allegedly recovered from Feb. 28 school strike in Minab show remnants consistent with a U.S.-made Tomahawk cruise missile. w/ @malachybrowne @johnismay nytimes.com/2026/03/09/world…
238
800
2,328
362,288
Max Bernhard | @mxbernhard.bsky.social retweeted
Feb 26
Israeli soldiers shot dead Jad, a Palestinian boy, denied paramedics access to him at gunpoint, & watched Jad bleed out for 45 min.Then kidnapped the body denying a burial. Their accusation: Jad was throwing a stone. Video shows they planted one #Palestine bbc.com/news/articles/cpqwv9…
55
1,291
1,936
73,663