4 casos · pág. 1/1
ESET analysis describes how modern phishing and social engineering have shed the classic tells (poor grammar, suspicious URLs, crude login pages) and increasingly target live sessions and authentication tokens rather than passwords. Cybercrime-as-a-service phishing kits and AI tooling lower the cost of tailored, rapport-building lures. Ac…
Check Point Research reports that commercial antidetect browsers Kameleo, AdsPower and MultiLogin are widely referenced on Russian-language underground forums and are used for account takeover, carding, fraudulent loan applications, ad-revenue fraud and coordinated inauthentic behavior (CIB). The tools spoof browser fingerprints, manage p…
Researcher Pedro Cruz (gankd) documents two Client-Side Path Traversal (CSPT) chains found in production bug bounty programs. The first turns CSPT into Stored XSS and account takeover on a payments platform's Angular POS single-page application. The second, found with Felipe Torres, triggers unauthorized account deletion on one of the lar…
TrustedSec researcher Lilly Mayo published waf-fu, an offensive tool that pulls AWS WAF log data into a local sqlite database and enables replay of logged requests. During an engagement, the author found WAF logs in CloudWatch that captured all headers unredacted, including session cookies and other authentication material, which can be r…
