> be JayTaelien > security researcher > discovered Discord zero day exploit > send Twitch embed to victim > something something > massive exploit chain > arbitrary code execution > only requirement is victim clicking a Twitch embed > Discord confirms 1 ClickRCE > pays him $5,500 Dawg, someone get Discord on the horn and tell their CEO his company is a fucking piece of shit. This exploit is devastating and if this guy didn't tell them, and instead decided to weaponize it, he could have fucking destroyed end users. All bro would have had to do is be like. "Check out this Twitch streamers clip", and destroyed their machine, executing any malware they wanted arbitrarily, stealing data, whatever. Bro could have gone to large Discord channels, shared the link, potentially infecting thousands upon thousands of people effortlessly He could have down more precise operations targeting prominent streamers, moderators, celebrities known to use Discord, and fucking wiped them all out with anything he chose to execute Imagine if he sold this exploit to ransomware groups He could have made millions of dollars, easily Imagine if he went into a cryptocurrency Discord and the payload was a cryptodrainer. He could have drained entire communities in seconds And they paid bro $5,500 That's absolutely sickening. JayTaelien is a fucking saint and decides a much larger payouf

Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click

🚨 EVILGINX EXTENSION IS OUT🚨 I am happy to say the free Evilginx Chrome extension has been approved and is finally available for download. 🥳 You can now safely import your captured session cookies, knowing that the cookie manager you're using came from a reputable source, along with the "trust me bro" quality seal. For a long time, I wanted to make the task of finding the cookies that hold session tokens much easier. With the Evilginx extension, you can now speed up the trial-and-error process when testing multiple cookie configurations to see whether you're still authenticated after a page reload (no more restoring cookie backups from external JSON files). I made this extension for myself, and I use it to kickstart the development of every single phishlet I make. Now you can too! 💪 To properly celebrate the release and help you get the most out of the extension, I released a walkthrough video with a rundown of all the features and a hands-on tutorial on how to use it to kickstart the development of your own phishlet for GitHub. Enjoy and happy phishing! 💗🪝🐟 Disclaimer: AI was used to develop the extension. UX, UI design, and minor code tweaks originated from a human brain. Code was read using human eyes. P.S. GitHub repo will arrive later. 🔗 Links can be found below 👇

RT @zerozenxlabs: 🚨 $15,000/MONTH — WE’RE HIRING AN ANDROID SECURITY RESEARCHER At ZeroZenx, we don’t care about diplomas. We care about w…

Telegram Desktop: one-click account takeover via IPC injection beaksec.github.io/posts/tele…

Have I Been Squatted registered аррӏө.com. It looks like Apple’s website address, but it’s a completely separate domain using different characters. We registered 20 lookalike .com domains in total as part of our latest research. Here’s what we found. 1/5 ⬇️

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.

realized we haven't really explained what we're building at vulone very well it's not just a threat intel or IOC database, even thought we do collect IOCs. we've profiled 9M+ threat actors and built an engine that connects their aliases, emails, IPs, wallets, PGP keys, accounts, infrastructure, etc to each threat actor. so you can start with basically one piece of information and trace the connections around it. we've also been collecting activity from underground communities to understand how these actors think, behave and operate, not just what indicators they leave behind. we built this on a budget of less than 5K$ other companies would spend 50k$ at least to get his up and running. because have brains and we know how to run shit, imagine what we could do with 50k, that's why we are currently seeking investment. I'm confident with enough funding, we can build something on a completely different level.

Just a reminder to all my cyber gangsters out here. Do not get lost on the path to FAST and EASY money. REMEMBER, not even ALL the crypto and USD in the WORLD would truly make you happy. And never forget, the most VALUABLE things in this life are FREE. #cybersecurity #infosec

🥷 Now we can inject a payload into a remote process without using VirtualAllocEx and WriteProcessMemory. No need to suspend the target process New technique to evade EDRs: Github: TwoSevenOneT/InjectSetConsole #redteam #pentest #antimalware

Just received the verdict in Malta Gaming Authority v. Wittmann. Good news: I can call the MGA an organized crime enablement scheme - and use the documents I obtained. Bad news: I’m not allowed to hack them again. #casinosecrets

A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.

Starting today, you can investigate for yourself who owns and operates casinos in Curaçao. I’ve just released part of the data from the Curaçao Gaming Authority. casinosecrets.lol/

Hello, i am alive and well :) its been fun. We're retiring within the next few weeks. I may continue posting on here if i do not lose the login credentials for my X. the supply chains were fun, and the researchers tracking us were cool for the most part. thanks for the memories.

New video of Kingbob aka Noah Urban in jail 👀 (he’s the one recording)

Thread 🧵 1/ 🚨 NEW RESEARCH: We identified a training program provided to government employees in Angola by the Israeli influence-for-hire company BlackCore. Full report: citizenlab.ca/research/black…

wtf did i find on github 😂 github.com/aifred0729-TW/Min…

Sad but necessary: nomeatproxy.com/