Court File No. CV-20-00645492-0000
Equibit Group Ltd. v. Attorney General of Canada et al.
In late 2021, shortly after relocating to Mexico, Chris Horlacher opened a Keybase account to speak with a new client’s internal team. The phone was a Google Pixel running GrapheneOS. On 25 October 2021 the account followed two users he did not know. On 3 December 2021 it followed two more. He had not made those connections. All four accounts belonged to people inside the financial-newsletter company he had just taken on as a client.
Equibit Group Ltd. records the sequence here as an endpoint observation in the technical-attack chronology. It is not a numbered eighth attack. It does not name an operator.
What the Keybase Account Did
Keybase was, at the time, sold as an end-to-end encrypted messenger with public identity proofs. Horlacher used it for the new client and for nothing else of consequence on that handset.
The unauthorized actions were follows, not messages. Two on 25 October 2021. Two on 3 December 2021. He found them, cut them, and then checked who the four accounts were. They were not strangers drawn from the wider Keybase directory. They were inside the client he had just onboarded.
A follow is a small action. Four follows, confined to one company, on two dates, without the account holder’s hand on the button, are not a mis-tap.
The Phone Was Running GrapheneOS
GrapheneOS is a hardened Android-based system: verified boot, strict app sandboxing, hardened memory allocation, and no Google services unless the user adds them. It is built to shrink the attack surface of a stock phone.
That is the point of the incident. The activity did not require a cracked lock screen or a sideloaded toy. It happened inside an account on a phone running one of the stricter public operating systems. The two readings that fit are a compromise of the Keybase account or client, or a compromise above the handset. Equibit Group Ltd. does not have a Keybase server log from those two days. The follows, and who they landed on, are the record.
The Four Accounts Were Inside the New Client
The targeting is the fact that will not sit still. Horlacher had just begun work for a financial-newsletter publisher. The account then attached itself to four people in that same company. He did not know them. He did not choose them.
That leaves the question the incident actually raises. Either Keybase, or the session on that phone, was in someone else’s hands. Or the client’s own circle was the object of the same attention. The page does not choose between those. It records that the follows were not random, and that they pointed at the new engagement.
What the Keybase Community Did With the Report
Horlacher put the incident to the Keybase forum on Reddit, under the title “Is there a RAT in Keybase?” The thread did not produce a technical account of how an account follows users on its own. It was largely ignored, and what reply it drew treated the report as the problem.
Keybase had been acquired by Zoom in 2020. By then Zoom was already under scrutiny for its dealings with U.S. government customers. That is context for who owned the platform. It is not a finding that Zoom, or any agency, operated this account. The finding on this page is narrower: the account moved, the user did not move it, and the community had no explanation.
Place in the Equibit Lawsuit
The October and December 2021 follows belong to the technical-attack chronology in Court File No. CV-20-00645492-0000. They sit beside the incidents collected in Seven Documented Technical Attacks Against Equibit and Chris Horlacher.
Further Reading
- Seven Documented Technical Attacks Against Equibit and Chris Horlacher
- Router Sabotage Exposed
- DNS Man-in-the-Middle Attack Exposed
- Microsoft Under Fire
- USB Plug and Unplug Sounds and Monitor Resolution Changes on Chris Horlacher’s Laptop
