Palantir CEO Alex Karp Posts Anti-Inclusivity Manifesto Attacking ‘Regressive’ Cultures

Palantir Technologies, the data analytics firm known for its work with U.S. immigration enforcement, has published a controversial 22-point manifesto that denounces inclusivity and what it calls “regressive” cultures. The document, posted on the company’s website, is a summary of CEO Alex Karp’s book “The Technological Republic” and has ignited fresh debate about the political leanings of Silicon Valley’s defense contractors.

Written by Karp and Palantir’s head of corporate affairs, Nicholas Zamiska, the manifesto argues that Silicon Valley owes a “moral debt” to the United States and warns that “free email is not enough” to justify the industry’s success. The post, which the company says it published “because we get asked a lot,” goes beyond typical corporate messaging to attack pluralism, critique post-war Germany and Japan, and advocate for AI-powered military deterrence.

What Does the Palantir Anti-Inclusivity Manifesto Say?

The manifesto takes direct aim at what it describes as “the shallow temptation of a vacant and hollow pluralism.” In Palantir’s view, a blind commitment to inclusivity ignores the fact that some cultures have produced great achievements while others have proven “middling, and worse, regressive and harmful.” This line has drawn particular criticism from observers who see it as an attack on democratic values.

Building on this theme, the document also criticizes the “postwar neutering of Germany and Japan,” arguing that the “defanging of Germany was an overcorrection for which Europe is now paying a heavy price.” It similarly warns that a “highly theatrical commitment to Japanese pacifism” could “threaten to shift the balance of power in Asia.” These statements reflect Karp’s long-standing belief that Western nations must adopt a more assertive global posture.

AI Weapons and the New Deterrence Era

Another key section of the manifesto focuses on artificial intelligence and national security. “The question is not whether A.I. weapons will be built; it is who will build them and for what purpose,” Palantir states. The company argues that adversaries “will not pause to indulge in theatrical debates about the merits of developing technologies with critical military and national security applications.”

This stance aligns with Palantir’s business model, which relies heavily on contracts with defense, intelligence, and immigration agencies. The company suggests that “the atomic age is ending” and that “a new era of deterrence built on A.I. is set to begin.” Critics, however, see this as a self-serving justification for expanding surveillance capabilities.

Reactions to Palantir’s Political Statement

Eli Higgins, CEO of the investigative website Bellingcat, offered a pointed response on social media, calling the manifesto “extremely normal and fine for a company to put this in a public statement.” His sarcasm underscored the unusual nature of a major corporation publishing such an overtly ideological document.

Higgins further argued that the manifesto is not simply a “defense of the West” but an attack on “key pillars of democracy that need rebuilding: verification, deliberation, and accountability.” He noted that Palantir’s revenue depends on the very politics it advocates, saying, “These 22 points aren’t philosophy floating in space, they’re the public ideology of a company whose revenue depends on the politics it’s advocating.”

Context: Palantir’s Role in Immigration Enforcement

The Palantir anti-inclusivity manifesto arrives at a time when the company faces increased scrutiny over its work with U.S. Immigration and Customs Enforcement (ICE). Congressional Democrats recently sent a letter to ICE and the Department of Homeland Security demanding more information about how Palantir’s tools are being used in the Trump administration’s aggressive deportation strategy.

Palantir has positioned itself as a defender of “the West” and a key player in national security, but critics argue that its technology enables human rights abuses. The company’s ideological bent has become a flashpoint in broader debates about the role of tech firms in government surveillance and military operations.

For more context on corporate political statements, check out our analysis of corporate political communication strategies. You can also read about AI ethics and defense contractors.

What This Means for Silicon Valley

Palantir’s manifesto suggests that the company sees itself as a moral actor, not just a service provider. It criticizes a culture that “almost snickers at [Elon] Musk’s interest in grand narrative” and calls for Silicon Valley to acknowledge its debt to the nation. However, many in the tech industry view this as a thinly veiled attempt to normalize far-right political positions.

As the debate over AI, immigration, and national security intensifies, Palantir’s willingness to publish such a document signals that the company is doubling down on its ideological identity. Whether this strategy will alienate customers or attract new ones remains to be seen. For now, the manifesto has succeeded in one thing: generating conversation about what a tech company should stand for.

Learn more about Silicon Valley’s political donations and influence in our dedicated report.

Mirax Android Trojan: Hijacking Devices for Proxy Abuse

Cybersecurity researchers have uncovered a new Android banking trojan that goes beyond typical credential theft. Known as Mirax Android Trojan, this malware not only steals sensitive data but also transforms compromised smartphones into residential proxy nodes. This dual functionality marks a significant shift in mobile threat tactics, blending remote access with proxy abuse to amplify the impact of attacks.

According to a detailed report from Cleafy, the malware is currently targeting Spanish-speaking users across Europe. Campaigns have already reached over 200,000 accounts through malicious advertisements on social media platforms. The trojan operates under a restricted Malware-as-a-Service (MaaS) model, limiting access to a small group of affiliates. This controlled distribution strategy helps maintain operational security while maximizing campaign effectiveness.

How the Mirax Android Trojan Spreads

Social engineering lies at the heart of the Mirax distribution chain. Attackers use fake advertisements promoting illegal streaming applications, such as IPTV services, to lure victims. These ads appear on popular social media platforms, directing users to download software from outside official app stores. The malware is hosted on GitHub with frequent updates, making it harder for security tools to track.

Once a user installs the fake app, the trojan executes a multi-stage process. It decrypts hidden payloads and establishes communication channels via WebSockets. These channels allow attackers to remotely control the device and extract data in real time. The malware also includes device checks designed to evade automated analysis, such as sandbox detection.

Remote Access and Surveillance Capabilities

The Mirax Android Trojan enables attackers to fully control infected devices. It can execute commands, monitor user activity, and deploy fake overlays on legitimate banking or social media apps. These overlays are fetched dynamically from command-and-control (C2) servers, making detection particularly challenging for antivirus software.

In addition, the malware integrates surveillance features like continuous keylogging and collection of lock screen details. This includes PIN structure and biometric usage patterns. As a result, attackers can gather credentials and personal information without raising suspicion. This means that even strong passwords or biometric locks offer little protection once a device is compromised.

Residential Proxy Abuse: A New Attack Vector

One of the most defining features of the Mirax Android Trojan is its ability to convert infected devices into residential proxy nodes. Attackers can route malicious traffic through legitimate IP addresses, bypassing geographic restrictions and fraud detection systems. This proxy capability extends the malware’s role beyond financial theft. Compromised devices become infrastructure for broader cybercriminal activities, including account takeovers (ATO) and anonymized network attacks.

Building on this functionality, the trojan allows attackers to launch secondary attacks that appear to originate from trusted residential IPs. This makes it harder for banks and online services to block fraudulent transactions. For a deeper look at proxy abuse in modern malware, check out our analysis of DeadLock Ransomware Using Polygon Smart Contracts for Proxy Rotation.

The Evolution of Mobile Threats

Cleafy’s research highlights that the Mirax Android Trojan reflects a wider evolution in mobile threats. Tools are becoming more modular and commercially structured, with malware authors adopting business-like models. The MaaS approach used by Mirax limits access to vetted affiliates, reducing the risk of exposure while increasing the sophistication of campaigns.

Although current campaigns focus on Spain, analysts warn that the malware’s reach is likely to expand as operators refine their tactics. Similar Android banking trojan trends show that geographic targeting often broadens after initial success. Users should remain vigilant and avoid downloading apps from unverified sources, especially those promoted via social media ads.

To stay protected, always install apps from official stores like Google Play, enable two-factor authentication, and use reputable mobile security software. If you suspect your device is compromised, run a full security scan immediately and change all critical passwords.

Bluesky Confirms Sophisticated DDoS Attack Behind Persistent App and Website Outages

Bluesky, the decentralized social network, has publicly confirmed that a sophisticated Bluesky DDoS attack is the root cause of the ongoing service interruptions that have plagued its platform since mid-April. Chief operating officer Rose Wang initially attributed the problems to a cyberattack, and the company later clarified that a Distributed Denial-of-Service (DDoS) assault began on April 15 at around 8:40 p.m. ET. This revelation has left many users frustrated as intermittent outages continue to disrupt feeds, notifications, and search functions.

As of Friday, the platform is still struggling to fully restore normal operations. The company posted on its official Bluesky account that the attack is “impacting our operations, with users experiencing intermittent interruptions in service for their feeds, notifications, threads, and search.” However, Bluesky has assured users that there is no evidence of unauthorized access to private data. For those seeking updates, the status.bsky.app page has been unreliable, often failing to load itself.

What Is a DDoS Attack and How Does It Affect Bluesky?

A Distributed Denial-of-Service (DDoS) attack involves flooding an app or website with massive amounts of junk traffic, effectively overloading servers and knocking them offline. This type of cyberattack does not involve breaching internal systems or stealing data, but it can be highly disruptive. In Bluesky’s case, the attack has caused the site and app to load slowly at times or display error messages like “This feed is currently receiving high traffic and is temporarily unavailable. Please try again later. Message from server: Rate Limit Exceeded.”

Popular feeds such as Discover and the official Bluesky Team feed are particularly affected, even when users’ personal feeds remain functional. Additionally, attempting to view a user’s profile often results in an error, forcing repeated refreshes. Bluesky protocol engineer Bryan Newbold noted the severity early on, posting around 3:46 a.m. ET on Wednesday, “oof, our services are getting hit pretty hard tonight.”

Impact on Users and the Broader Decentralized Ecosystem

The Bluesky outage has not only frustrated regular users but also sparked a notable shift within the decentralized social network ecosystem. Communities like Blacksky, which run their own infrastructure on the underlying AT Protocol, have remained functional. Blacksky’s team reported a “significant spike” in migration requests from Bluesky users over the past 12 hours, as alternatives like Eurosky and other ATmosphere founders promoted their services. This demonstrates how a major Bluesky DDoS attack can accelerate user movement within the decentralized web.

For many users, the intermittent nature of the outages adds to the frustration. One moment the app loads, albeit slowly; the next, it displays error messages. The company has not provided a definitive timeline for a fix, though it promised an update by 1 p.m. ET on Friday. Meanwhile, the status page itself has been unreliable, with a typo visible in one message: “investigating an incident with service in one of our reginos [sic].” This suggests the team is operating under significant pressure.

Bluesky’s Response and Mitigation Efforts

Bluesky’s team worked through the night to mitigate the attack, but it intensified throughout the day. The company has been transparent about the cause, but the lack of a rapid resolution has tested user patience. As of now, the best advice for users is to check Bluesky’s status page for updates, though it may not always be accessible. For those considering alternatives, the decentralized nature of the AT Protocol means other services like Blacksky remain operational, offering a temporary refuge.

This incident highlights the vulnerabilities even in modern, decentralized platforms. While DDoS attacks are not new, their sophistication continues to evolve. Bluesky’s experience serves as a reminder of the importance of robust cybersecurity measures and backup infrastructure. For more on how social media platforms handle cyber threats, read our guide on securing your social media accounts.

What’s Next for Bluesky?

Building on the current situation, Bluesky must prioritize restoring full service and preventing future attacks. The company has not indicated whether it will implement additional protections, but the incident underscores the need for scalable defenses. As users explore alternatives, Bluesky’s ability to recover quickly will be crucial for retaining its community. The decentralized social network model offers resilience, but as this Bluesky DDoS attack shows, no platform is immune to disruption.

In the meantime, affected users can follow alternative decentralized platforms that are still functioning. The team at Bluesky continues to work on mitigation, and we will update this story as more information becomes available.