CrypticSploit @CrypticSploit

‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs." The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can. Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept. He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."

58 339 2K 278K 581

View Details

Nightmare Eclipse @ChaoticEclipse0

3 weeks ago

They forgot to add "We will only pursue legal action if you don't do it exactly like we told you to do it and even if you do it like we told you to, we will still sue you anyways." That public threat could've been just an email for me, but you know I don't care enough.

4 16 655 19K 16

View Details

jeo @lolit_speed

4 weeks ago

W opsec ❤️‍🩹

71 2K 32K 932K 3K

View Details

Cash App @CashApp

4 weeks ago

AI this and AI that Aye, I still need you to Cash App me for brunch

607 223 2K 161K 35

View Details

Mololuwa | Cybersecurity - (The God Complex) @cyber_rekk

4 weeks ago

Change your IP every 10 secs automatically

97 694 5K 650K 5K

View Details

Crypto Jargon @Crypto_Jargon

4 weeks ago

🚨BREAKING: THE AI BUBBLE HAS STARTED TO BURST MICROSOFT JUST TOLD 100,000 ENGINEERS TO STOP USING CLAUDE BECAUSE THE BILLS EXPLODED.. UBER BURNED ITS ENTIRE ANNUAL AI BUDGET BY APRIL.. Microsoft invested $5 billion in Anthropic.. gave 100,000 engineers Claude Code access.. encouraged adoption.. watched usage explode.. then the invoices arrived.. and issued an internal order to cancel nearly all Claude Code licenses by end of June and force everyone onto their own cheaper tool.. the company that bet $5 billion on Anthropic just told its own engineers to stop using Anthropic's product because it costs too much.. Uber rolled out Claude Code in December 2025.. by March 84% of their 5,000 engineers were using it.. 70% of all committed code was coming from AI.. heavy users burning $500 to $2,000 per month each.. the CTO spent $1,200 in a single two-hour demo.. they built internal leaderboards gamifying AI consumption.. and blew the entire annual budget by April with eight months remaining.. then Nvidia's VP of applied deep learning said it out loud.. "for my team the cost of compute is far beyond the costs of the employees".. a VP at the company that sells the chips said using AI costs more than paying humans.. but here's the part that broke my brain.. Goldman Sachs forecasts a 24x increase in token consumption by 2030.. Gartner says even as per-token prices drop 90% total enterprise AI costs go UP because agents consume exponentially more tokens per task.. the more powerful and useful the AI becomes the more expensive it is to run at the scale that makes it transformative.. every CEO for two years said the same thing on every earnings call.. AI reduces headcount and cuts costs.. the stock went up every time.. workers got fired.. stock went up.. AI strategy announced.. stock went up.. $725 billion in AI infrastructure spending this year across Big Tech.. and the first companies to actually deploy these tools at real scale are already pulling back because the invoice arrived before the productivity gain was large enough to cover it.. the gap between what the earnings call said and what the invoices say.. is the most important number in markets right now.. and nobody on Wall Street has priced it in yet.

142 713 2K 551K 1K

View Details

Christopher | 🇺🇦  @d4rkshell

4 weeks ago

Microsoft has banned Nightmare Eclipse from GitHub: github.com/Nightmare-Ecli… This is the researcher who disclosed several zero-days after Microsoft also deleted their MSRC account. They have now moved on to GitLab: deadeclipse666.blogspot.com (h/t to: @[email protected])