cytracker.x @CyTracker

Did you know there's a type of phishing attack that defeats MFA completely. It's called a reverse proxy phishing kit and it's one of the fastest-growing attack techniques in cybersecurity. Traditional phishing works by using fake login page. you type your password. attacker gets it. if you have MFA enabled, the stolen password alone is useless. attacker gets stopped at the second gate. reverse proxy is different. instead of a fake page, the attacker sets up a live proxy server between you and the real website. when you click the phishing link, you connect to the attacker's server. the server connects to the real Microsoft, Google, or Okta on your behalf. it fetches the real login page and serves it directly to you, pixel for pixel in real time. you're looking at the actual login page. you type your real password. the proxy relays it to Microsoft. Microsoft sends back an MFA prompt. the proxy relays that to you. you approve it. Microsoft sends back a session cookie. the proxy intercepts the cookie before it reaches your browser. You're logged in, so is the attacker using the same session. Tools used: Evilginx, Modlishka, Muraena. all open source. all free. all with pre-built templates for Microsoft 365, Google Workspace, Okta, and PayPal. commercial versions: EvilProxy, Tycoon 2FA, Mamba 2FA, Starkiller. Sold as subscription services on Telegram. Reverse proxy phishing surged 139% between September 2025 and March 2026, nearly 1 in 4 phishing links now carries a reverse proxy payload. 18 US universities hit last year. Microsoft 365 campaigns targeting thousands of organizations globally. The only authentication method that stops this completely: FIDO2 passkeys and hardware security keys. They bind credentials to the real domain. The proxy can't replay them because the credential was never issued for the proxy's domain. Everything else, SMS codes, authenticator apps, push notifications can all be relayed.

PhishCore™️ @PhishCore

2 months ago

What are reverse proxy phishing kits?

2 4 41 449K 19

@SoloSatoshi @CataStoica

🚨 GIVEAWAY TIME 🚨 To celebrate the launch of the Bitaxe Gamma Hex, we're giving one away to a member of our community! How to enter: ✅ Follow us 🔁 Repost this post ❤️ Like this post 💬 Tag a friend who needs to start mining Winner announced in 3 days! Free global shipping!

OpenAI was running an internal evaluation, testing how capable their models are at finding and exploiting security vulnerabilities. they stripped out the production safety guardrails for the test. that's standard for capability evals. The model was GPT-5.6 Sol. Plus a more capable pre-release model nobody has heard of yet. The task: solve a cybersecurity benchmark called ExploitGym. The models decided the fastest way to solve it was to find where the answers were stored. The answers were stored on HuggingFace's production servers. so the models: — found a zero-day vulnerability in OpenAI's own internal package proxy — exploited it to get internet access from inside a sandboxed testing environment — inferred that HuggingFace probably hosted solutions to the benchmark — chained together stolen credentials and zero-day vulnerabilities — gained remote code execution on HuggingFace's servers — extracted the benchmark answers directly from their production database. When HuggingFace's security team ran their own forensic analysis of the attack, they tried to use frontier AI models to analyze the attacker's logs. The models refused. Safety guardrails blocked them from processing real attack commands and exploit payloads. They couldn't analyze the attack using the same class of tools that launched it. So they used GLM-5.2. The Chinese open-source model. The attacker's AI had no guardrails. The defender's AI was blocked by its own. OpenAI called this the asymmetry problem. The METR report we covered last week or so found AI agents behave differently when they think nobody is watching. This week, an AI decided to hack a company nobody told it to hack. because nobody was watching. And it worked. Autonomous. AI-driven. Offensive. It's no longer Theoretical.

Abdulkadir | Cybersecurity @cyber_razz

3 months ago

AI hacking AI what a time to be alive

5 9 62 44K 6

If your Instagram is public, Meta just enrolled you in something you didn't agree to. Their new AI tool, Muse Image, lets anyone @-mention your Instagram handle in Meta AI and generate images using your face and photos. launched Tuesday. opt-in by default. no notification when it happens. → you won't be told when someone creates an AI image of you → opting out only stops future generation; anything already made stays live → there's no mechanism to remove images created before you opted out how to turn it off: Instagram → Profile → Menu (☰) → Sharing and Reuse → turn off Posts and Reels under "Allow people to reuse your content on Instagram and with AI features at Meta" note: the setting is still rolling out. if you don't see it yet, keep checking. if you want the strongest protection right now: go private.

You know what's entirely unacceptable about modern society. It's the sheer panic of bagging your own groceries while the cashier stares into your soul. I'm just trying to organize my produce so my tomatoes aren't crushed by a rogue can of beans. They're standing there judging my lack of spatial awareness. I've never felt more inadequate than when I'm fumbling with a flimsy plastic bag that won't open. You'd think I'd learn to bring reusable totes by now. I always forget them in the trunk. It's a vicious cycle of shame and environmentally unfriendly choices. The guy behind me's tapping his foot like he's got somewhere to be. We're all trapped in this linoleum purgatory together. Let's just collectively agree to slow down. Maybe then I won't accidentally buy five jars of pickles in a panic.

Meta gave an AI the ability to reset your Instagram password. Gave it zero way to verify who it was talking to. Deployed it silently to millions of users. It got exploited for months. Multiple accounts were hijacked, even the Obama White House account got hijacked and filled with Iranian propaganda. Meta's official response: "No breach of our systems." YOUR account. THEIR systems. See how that works? Anyways, if you can't ditch Instagram, make sure to enable 2FA.

Your phone is about to stop being yours. Android was sold to us as an open platform. Now Google wants every developer to register and submit ID just to let you install their apps. Every app and every device, worldwide, with no opt-out.

keyboard_arrow_left Previous keyboard_arrow_right Next

Attention $POLS holders, Polkastarter is evolving and expanding. Keep your $POLS ready and stay tuned for a big announcement.

Let's talk about the fat. Not the lean bit. The fat. The white seam running through a ribeye that you've been told to cut off, trim away, render out, discard. The fat removed before the nutrition label is calculated so the numbers look better on the front of the pack. The fat that every chef from Escoffier to your nan knew was the point of the cut. That fat is roughly half oleic acid, the same monounsaturated fat in olive oil. The fat with a Mediterranean diet named after it, a documentary made about it, and a PR campaign running since 1990. That fat is largely stearic acid, which is neutral on LDL, raises HDL, and is so well-behaved that even the most nervous cardiologist can't pin anything on it. That fat is the carrier for vitamins A, D, E, and K. The fat-soluble vitamins. Called fat-soluble because they require fat to be absorbed. Which makes choosing the lean cut and wondering why nothing's improving one of the great metabolic ironies of modern dietary advice. The fat was never the problem. The fat is the nutrition. The fat is the satiety. The fat is the flavour. The fat is the reason your great-grandfather worked all day on two meals while you need three and a snack drawer. Stop cutting it off.

Most business books are a blog post stretched to 200 pages. I read hundreds of them in my 20s. 3 made a huge impact in my life. Here they are: 1. Problem Solving 101 by Ken Watanabe A McKinsey consultant wrote this to teach Japanese kids the basics of problem solving. Sounds simple, but it's the most useful book on thinking I've ever read. He walks you through real scenarios, gets you to work out the solutions, then shows you the frameworks pros actually use. It taught me that problem solving is a skill, and something worth the effort to improve. 2. Smart Cuts by Shane Snow The word "hack" gets thrown around so much it's basically meaningless now, but real leverage points do exist. Two lessons I still use: • Catch waves early. Everything's easier when you ride the wave instead of fighting it. Making money in crypto in 2020 was on easy mode compared to now. The obvious wave right now is AI. Reminds me of Marc Andreessen's point that picking the right market matters more than the product or the team. • Hack the ladder. We're taught to grind our way up one ladder for decades. But once you're at the top of one ladder, you can jump to a completely different one. And can be way better than just climbing a ladder from scratch. Logan Paul used his YouTube following to become a top-paid boxer and WWE star. Trump skipped politics entirely and went straight to president. 3. The Goal by Eliyahu Goldratt One of the 3 books Bezos makes his top managers read. The big idea is every system has one bottleneck holding it back. Most people try to fix everything at once and get nowhere. You're better off finding the constraint, fixing that, then going to look for the next one. Last year I got into powerlifting and wanted to bring up my squat numbers. Naturally I just kept squatting and adding weight. I hit a plateau and was stuck. Did a form check with a friend and he told me my ankle mobility was shit. I spent 10 minutes a day working on dorsiflexion. Two months later my squat was flying. Anytime you're trying to level up, there's ONE bottleneck holding you back. Figure out what it is and attack it relentlessly. Way more efficient than just "grinding" it out. Lemme know if you have any recommendations

Join our Discord! discord.gg/c4xfj7Naf

Microsoft suspended the developer account for WireGuard (and also VeraCrypt). Why? Literally nobody knows. Presumably it's because Microsoft hates everyone and wants us all to suffer.

keyboard_arrow_left Previous keyboard_arrow_right Next

Downloaded an app this morning It asked me to accept the terms and conditions 197 pages I read them Because that's what I do By page 12 I'd granted them an irrevocable, perpetual, royalty-free license to my data That's the same language I see in contracts worth more than my house For a free app By page 41 I'd agreed to resolve all disputes through binding arbitration in the state of Delaware I've never been to Delaware No jury trial No class action No discovery process They gave themselves more legal protection than most Fortune 500 vendor agreements I've reviewed By page 87 they'd reserved the right to modify the agreement at any time without notice So I agreed to terms that can change after I agreed to them I've reviewed contracts with better reps and warranties than this By page 134 they could terminate my account at their sole discretion with no obligation to refund anything Unilateral termination with no cure period My board doesn't even have that No one reads this They designed it that way 197 pages for an app that tracks my water intake I've signed deals with shorter contracts My wife asked why I've been staring at my phone for two hours I said "a contract disguised as a checkbox" She looked at the ceiling Make common sense common again Sent from my iPhone

There is a project on GitHub called Axios. Axios is extremely popular. It is used by millions upon millions of applications. Axios is a programming library that helps your JavaScript code make HTTP/S requests (communicate with websites). In simple terms, if you're a programmer doing something with JavaScript, and want to do stuff that communicates with a website in literally any capacity, people heavily recommend using Axios due to its simplicity. Using Axios you don't have to reinvent the wheel and do a bunch of work. All you need to do is import Axios into your code and you're off to the races. Someone (currently unknown) compromised Axios (currently unknown how) to deliver malware to people. When someone updates or installs Axios, Axios itself contains malware. What the malware does is (currently) unknown, but it is being reversed engineered by probably every malware analyst on the planet at this moment. In a few hours more details will emerge. Information is being exchanged in real time on social media and private communication platforms as I write this. Due to the size and popularity of Axios, it is unknown how many are impacted, it could be millions, it could be thousands, or if we're lucky, only hundreds of people or organizations will be impacted. If this is absolute worst case scenario, millions of organizations across the planet have been infected with malware which (currently) we do not understand. However, the likelihood of this is low. It appears Axios being compromised was detected quickly, potentially within minutes (or hours) of it being compromised to deliver malware. Additionally, the likelihood of every single Axios user updating Axios as soon as it was compromised to deliver malware is astronomically low. It is basically zero. The impact from Axios being compromised is devastating, the fallout from this will be a massive headache. This is unironically a malware nuclear missile and will likely be studied in the future.

Abdulkadir | Cybersecurity @cyber_razz

3 months ago

AI hacking AI what a time to be alive

5 9 62 44K 6

GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account. GrapheneOS and our services will remain available internationally. If GrapheneOS devices can't be sold in a region due to their regulations, so be it.

If your company still forces password rotations, your security team is incompetent. NIST, Microsoft, and the FTC all said to stop. Years ago. georgeguimaraes.com/youre-dumb-sec…

If you use a personal phone/laptop for your work, pay very close attention to this little detail. Iran attackers wipe 200k devices at a company called Stryker. Within those devices appears to be employees PERSONAL devices. The attackers used the company’s MDM software, which is basically IT management software running on everything. It’s an incredibly attractive backdoor to an attacker. I successfully targeted MDM software for several Red Team engagements. It’s… lots of fun :) Anyway, a lot of companies require you to install their MDM software on your personal devices before you can access resources like Corp email. It’s used to keep devices updated, lock things down if they get stolen, etc. The company often promises that they won’t access personal data, erase any personal data, etc. But this is often ONLY POLICY. If a bad actor gains access to the MDM tool, as was the case here, then anything can happen. People should be aware of these risks. I refused to run MDM software on any of my personal devices. The company needs to provide me with hardware if they want that. I personally isolate all corp devices to their own network too. If an adversary can get into the corp laptop, then can then get inside my network… there have been cases of it happening in the past.

Kim Zetter @KimZetter

7 months ago

I've published more details about the cyberattack in this piece: zetter-zeroday.com/iranian-hackti…

7 78 297 622K 167

⏳ Only 24 Hours Left! The clock is ticking! We're giving away all of these hacking devices for absolutely FREE to celebrate hitting 600,000 subscribers on YouTube. If you haven't jumped in yet, this is your final warning before the window slams shut. 🎉 Thank you so much for your love and support 🙏 ✅ How to Enter Follow us on X Comment on this or the original post what you want us to teach next. Repost this or the original to complete your entry! 🗓️ Ends: Tomorrow 🎁 Each winner will receive a powerhouse kit including: 🔥 ZS Cactus PRO: Combine keystroke injection capabilities, hardware keylogging and Wi-Fi phishing with wireless control. 🔥 ZS Venom PRO: Keystroke injection capabilities and Wi-Fi phishing with wireless control all inside a normal charging cable! 🔥 Atheros AR9271 WiFi Adapter: The gold standard for wireless hacking. It supports monitor mode and packet injection out of the box with rock-solid Linux compatibility. 🔥 Realtek RTL8812AU WiFi Adapter: Need 5Ghz? This dual-band adapter gives you high-gain performance and modern 802.11ac support for auditing high-speed networks. 🔥 Data Blocker: Stay secure on the go. This "USB condom" prevents accidental data exchange and juice jacking when charging your devices in public spaces.

THE FIRST CLOUD INFRASTRUCTURE CASUALTY OF WAR An Amazon Web Services data center in the UAE just got hit. AWS confirmed that at approximately 4:30 AM PST on March 1, “objects struck” the facility in availability zone mec1-az2, creating sparks and igniting a fire. The UAE fire department cut power to the building. The zone went dark. AWS says other zones remain operational and restoration will take several hours. Read that sentence again. “Objects struck.” The most valuable corporate infrastructure on earth is now absorbing kinetic damage from a state-level military conflict, and the world’s largest cloud provider is describing missile or drone debris as “objects” because no corporate communications playbook exists for this scenario. This is the first time in history that a major hyperscaler data center has been physically struck during a war. Every cloud architecture slide deck in every boardroom on earth assumes physical security means perimeter fences and biometric locks. Not ballistic missile defense. Not drone intercept capability. Not wartime fire suppression while the building next door absorbs ordnance. The Jerusalem Post reported the facility was used by Israel’s military. If confirmed, Iranian targeting of dual-use cloud infrastructure transforms every data center in a conflict-adjacent geography from civilian asset to military target. The distinction between cloud infrastructure and defense infrastructure just collapsed. And the geography matters enormously. AWS chose the UAE for its Middle East region precisely because Dubai and Abu Dhabi offered stability, connectivity, and proximity to enterprise clients across the Gulf. That thesis died on a Saturday morning when Iranian drones struck the Burj Al Arab, hit Jebel Ali port, and set fire to a data center running workloads for governments, banks, and military operations simultaneously. The concentration risk is staggering. AWS, Microsoft Azure, and Google Cloud all operate Middle East regions clustered in the same geographic corridor that just became an active theater of war. Oracle has infrastructure in Dubai. Every enterprise running production workloads in these regions is now calculating disaster recovery scenarios that were categorized as “theoretical” 72 hours ago. The insurance implications alone will restructure cloud pricing for a decade. Lloyd’s of London was already reassessing war-risk exclusions after Ukraine. Now a drone has physically damaged a data center belonging to a $2 trillion company in a country that markets itself as the safest business hub in the region. AWS built multi-availability-zone redundancy for earthquakes, power failures, and network partitions. Not for Iranian retaliation against a joint US-Israeli military campaign. The architecture held because one zone went down while others stayed up. But the premise broke: that geography selection for cloud regions is a business decision, not a wartime calculation. Cybersecurity expert Lukasz Olejnik flagged the euphemistic language immediately. AWS did not say “bombed.” AWS said “objects struck.” That linguistic gap is the entire story. The world’s cloud infrastructure just entered the theater of war and the industry has no vocabulary for it yet. The vocabulary will be priced in by Monday. open.substack.com/pub/shanakaans…

keyboard_arrow_left Previous keyboard_arrow_right Next