He was surfing the dark web—not for anything illegal, just for the thrill of seeing the underbelly of the internet from the safety of his Surfshark-encrypted tunnel. The VPN hummed in the background, its kill switch ready, its CleanWeb filter blocking the usual garbage. Leo felt invincible, wrapped in layers of AES-256 encryption.
Unplug.
Not a crash. Not lag. A flicker , like someone had blinked inside the monitor. A terminal window opened on its own, typed three lines, and closed: Connection secured. Macro protocol engaged. You shouldn't be here, Leo. He stared at the blinking cursor of his own command line, heart doing that thing where it forgets to beat for a second. He hadn't typed his name anywhere. Not on this machine. Not on this OS. He was running a live USB, for God's sake. surfshark macro
He checked Surfshark. Still connected to a server in Iceland. No leaks. No alerts. He ran a packet capture—nothing. But something had reached through his VPN like it was wet tissue paper. He was surfing the dark web—not for anything
Leo leaned back, the cheap office chair squeaking under him. His reflection in the dark monitor looked pale, young, scared. He was a cybersecurity grad student. He knew threat models. He knew that VPNs weren't magic. But this? This was like finding out the lock on your front door was perfect—but the wall next to it was made of cardboard. Unplug
It was a session transcript. His session. From three nights ago. Every site he'd visited. Every keystroke he'd typed before the VPN engaged. The moment his Wi-Fi connected to his router—before the tunnel was up—someone had siphoned his raw data.
The post was short: "Encryption hides your data. The Macro hides the fact that the data was ever there. Surfshark, Nord, Express—doesn't matter. If the Macro sees your handshake, it owns your session. You're not anonymous. You're just politely ignored." Below it, a log file. Leo downloaded it, scanned it with three different antivirus engines. Clean. He opened it.