I hacked back this phishing kit and found X accounts with millions of followers I could control.
I received this email yesterday. Obviously a phishing attempt for an X account take over.
Most likely a compromised email or SMTP server.
I received this email yesterday. Obviously a phishing attempt for an X account take over.
Most likely a compromised email or SMTP server.
A quick fuzz of the malicious application endpoint revealed https://xoauth-mgr-2026[.]fly[.]dev/setup.php
As well as a username and password for the dashboard
The threat actor did not follow instructions.
As well as a username and password for the dashboard
The threat actor did not follow instructions.
Login panel located at xoauth-mgr-2026.fly.dev/login
Now.. this is the interesting part.
A vibe coded admin dashboard where the threat actor can take action on the accounts which authorized to that malicious X app through the phishing kit.
A vibe coded admin dashboard where the threat actor can take action on the accounts which authorized to that malicious X app through the phishing kit.
Clicking into any account gives me the ability to take actions as that user.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
