@yogsec.bsky.socialBug Bounty Tip: Account Takeover via Password Reset Link Reuse
Look for:
GET /reset?token=abc123 → POST /reset-password
Test by reusing the same token twice, or requesting multiple reset links.
Telegram channel: t.me/bugbountyusa
#BugBounty #PasswordReset #AccountTakeover #TokenReuse #InfoSec
@yogsec.bsky.socialBug Bounty Tip: 2FA Bypass via Response Manipulation
Look for:
POST /verify-2fa returning {"success":false} or {"verified":false}
For more tips join our Telegram channel: t.me/bugbountyusa
#BugBounty #2FABypass #AccountTakeover #ResponseManipulation #InfoSec
@thedailytechfeed.comHigh-severity bug in Telegram Desktop pre-7.2.9 lets attackers steal files and take over accounts with one click. #Telegram #Security #Vulnerability #CVE2026 #AccountTakeover https://thedailytechfeed.com/one-click-telegram-desktop-weakness-lets-attackers-steal-files-hijack-accounts/
@securityonline.bsky.socialA critical Telegram Desktop account takeover vulnerability (CVE-2026-107181) exposes users to session hijacking. Exploit details and PoC are now public.
#Telegram #Cybersecurity #CVE2026107181 #AccountTakeover #PoC
@radiohack.bsky.social📣 New Podcast! "Microsoft X Account Hacked: Crypto Scammers Exploit 13 Million Followers" on @Spreaker #accounttakeover #clippy #cryptocurrency #cryptofraud #cryptoscam #cyberattack #cybercrime #cybersecurity #cyberthreats #digitalsecurity #hacking #infosecurity #mfa #microsoft #microsofthack
@cyfar.ca@socket.dev
Fake PDF verifier steals Google session cookies and can reset passwords.
-
IOCs: pdf[.]gusercontent[.]com, pdf[.]gusercontent[.]com/api/accounts/collect/, pdf-para-texto@extensao[.]local
-
#AccountTakeover #Malware #ThreatIntel
@ahmandonk.bsky.social📰 TrustSink: Penyedia MFA Eksternal Nakal Bisa Mencuri Password Saat Login Microsoft Entra
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/trustsink-microsoft-entra-rogue-mfa-provider-curi-password/
#accountTakeover #authentication #authenticationPolicyAdministrator #cloudSe
@ahmandonk.bsky.social📰 EvilTokens PhaaS Dibekuk Setelah Membobol 12.000 Akun Microsoft
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/eviltokens-phaas-bobol-12000-akun-microsoft/
#accountTakeover #ai #bec #businessEmailCompromise #cloudSecurity #credentialTheft #cybercrime #cybersecurity #devic
@hacks.grFake admin-level access keys were found in a watchTowr test network, linked to real access attempts against WSO2 products.
Fixes are availa…
@hacks.grMicrosoft warns that scammers are impersonating corporate IT support to access Microsoft 365 accounts.
Fake sign-in pages and…
@iftas.mastodon.iftas.org.ap.brid.gyThere is a spate of #AccountTakeover underway.
Service providers may receive reports for accounts that have a display name beginning with "Hacked -" or linking to "t[.]me/HomeFucker5"
These accounts may be longstanding valid […]
