The Seven Coolest Inventions From 'DEF CON' 2026

DEF CON, the annual hacker convention held in Las Vegas, Nevada, just concluded its 2026 event. Between the convention’s Main Stage talks, vendor floors, and Demo Labs displays, this year’s event displayed some amazing feats of anti-surveillance technology built by open-source and independent developers or cybersecurity experts. 

There’s a device that detects nearby Flock cameras, an encrypted handheld device for sending texts without relying on carrier networks or the internet, a risk calculator for third-party web browser extensions, and an advanced spyware detector for smartphones. I spent my weekend analyzing all of them, going through reams of on-the-floor footage and announcement pages. These are the things that struck me as most interesting. 

Flock You and OUI-SPY by Colonel Panic

Flock Safety’s automated license plate reading (ALPR) cameras have been the focus of every cybersecurity and surveillance conversation in 2026. They quietly scan license plates to send out automatic alerts to law enforcement and federal agencies, with the advertised goal of cracking down on criminal activity. However, that's not always the case: Reports show law enforcement has used Flock data to track immigrants and people potentially seeking abortions, as well as spy on partners and romantic interests. 

A very interesting gadget to come out of DEF CON 2026 is this technology developed by a DIY hardware enthusiast who goes by “Colonel Panic.” It’s a lightweight firmware called Flock-You that can be installed on any ESP32 microcontroller.  You buy an ESP32 chip for $10 to $15, load the firmware onto it, and use it to listen for wireless signals that alert you when a surveillance camera like Flock is nearby. If you don’t want to bother yourself with the DIY setup, Colonel Panic also sells packaged ESP32 boards with the Flock-You firmware pre-loaded into them. These are called OUI-SPY detectors, and you can get them for as little as $85 apiece.

There are a few caveats, like how the Flock-You firmware won’t work on Arduino or Raspberry Pi microcontrollers because they are tuned into the ESP32’s specific wifi and Bluetooth infrastructure. Also, Flock cameras are already being adjusted to evade this detection technology, so it will probably only work on older or unpatched models. 

The Biscuit Ultra by Hedge

If there was ever a Swiss Army knife of anti-surveillance tech, Biscuit Ultra is probably it. This is a handheld device designed by a hacker known as Hedge that scans nearby wireless signals for several telltale signs of surveillance tech in your vicinity. Then it will feed you information like: 

A list of all nearby wifi networks

Flock or Axon cameras in your range

If the same device or gadget keeps popping up everywhere you go

Of the three features, I think the third one is probably the most useful of the bunch. You’ll get automated alerts if the same smartphone, tracker, or GPS device is following you around over time, which is a good indicator of whether you’re being actively tracked without your knowledge. The device is designed to look inconspicuous, like a small handheld router with two swivel antennas. Right now, a single unit costs about $160 on the Biscuit Shop.

Rayhunter by the Electronic Frontier Foundation (EFF)

Law enforcement officials in the United States use devices called IMSI-catchers (nicknamed “Stingrays”) that can track cellphones by pretending to be a cell tower. They send out strong signals that phones mistake for a real tower, which leads them to disconnect from the local tower and connect to the catcher instead. Once connected, Stingrays can track your real-time location and call logs without anyone the wiser. It’s a technique commonly used by local police departments, the FBI, and ICE, for example. Worse still, when these devices are active, they catch stray data from all other cellphones in the vicinity, even if their owners weren’t persons of interest in an investigation. 

Federal agents are required to obtain a search warrant before deploying these tools except in "exigent circumstances," but that likely isn't enough to preserve the general public's privacy. The Electronic Frontier Foundation has developed a new tool called Rayhunter to detect any suspicious towers that could be Stingrays in the vicinity. It runs on any off-the-shelf mobile hotspot, which the EFF says can cost as little as $20. You simply load the EFF’s free software into the hotspot, and it lights up red if there’s any suspicious tracking behavior from nearby towers. 

Exploitee.rs is a cybersecurity research group that specializes in IoT security, home automation, entertainment devices, and smartphones. They built a radio communication device called The Hacker Pager, which looks like a retro-style handheld smartphone with a screen and mechanical keyboard.

Unlike cellphones, The Hacker Pager does not rely on cell towers or internet connectivity. This low-tech gadget uses radio waves that transmit from device to device instead, based on an open-source firmware called Meshtastic. With the 2026 firmware update, Exploitee.rs’ device now supports external Bluetooth keyboards, multichannel communication, and more customization options for things like notification sounds. While secure, it’s not very long-distance, because the signals only travel up to thirty miles—assuming that there's a clear line of sight with no obstructions. 

Phasmid by Mr. Rabbit

This one’s still a prototype, but it’s worth a look anyway for the idea alone. Makoto Sugita, or “Mr. Rabbit,” showed off a deniable storage system that can create a fake version of your local file storage. That way, you can keep confidential data hidden from the people around you. 

Phasmid is an open-source Python app that can be installed on a device that splits your local storage into two slots—one real, and the other a fake version that you designed with your sensitive data removed. When someone tries to physically coerce you into handing over your device, Phasmid pulls up a “safe” version of your local storage that has all the sensitive data scrubbed from it, without revealing anything else. 

Since it’s only a prototype, Phasmid can only be installed on Raspberry Pi devices for now, and a macOS version is currently under development. It’s more of a proof of concept as it stands, but an interesting look at a tool that solves a specific problem that not a lot of technology is designed to secure against. 

L.A.Y.E.R.S. by Abhinav Khanna and Krishna Chaganti

Fake extensions with security issues have been a recurring concern for web browsers. Many of these extensions also pretend to be ad blockers or coupon finders, quietly tracking your online activity, logging keystrokes, or switching on your mic and webcam. Most people don’t even notice such a thing until they receive a ransom email or end up in a data breach. L.A.Y.E.R.S., designed by cybersecurity researchers Abhinav Khanna and Krishna Chaganti, scans your currently installed browser extensions to assign each a risk score based on their behavior patterns. 

L.A.Y.E.R.S. is currently available as a downloadable package on GitHub. It runs locally on your web browser, without sending any data to third-party platforms via API. Every browser extension you have installed gets scanned for suspicious permission requests, malicious JavaScript or HTML, risky external endpoint URLs, and other common patterns among malicious plugins. You end up with a simple risk score that grades each extension between one and 100, with lower scores indicating a higher security risk. 

IsMyPhonePwned by Anthony Desnos

IsMyPhonePwned offers an answer to the question: “What should I do if I think my phone has spyware on it?” Normally, you’d be forced to employ expensive forensic cybersecurity experts or pay for an antimalware platform like BitDefender or Norton. But Anthony Desnos developed IsMyPhonePwned as a free alternative to expensive spyware detectors that require you to install a cumbersome app on your phone which would also give away your suspicions to the attacker. 

Desnos’ tool is a web application you can run from your desktop PC. You connect to your compromised smartphone over USB, and IsMyPhonePwned generates a bug report for you. You can run this check on both Android and iOS devices. If you suspect a specific app of being spyware, there’s also a tool here called droid2web that can scan Android app packages separately.