Daily Writeups
@Daily_Writeups
3.49K subscribers
2 photos
128K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.49K subscribers
Daily Writeups
⤷ Title: Peering into the Cloud: Decode Windows Defender’s MAPS Protocol with the MAPS Cloud Scanner
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:41:37 +0000
════════════════════════
⌗ Tags: #Open Source Tool #API Fuzzing #Bond Protocol #cybersecurity research #malware analysis #MAPS Cloud Scanner #Microsoft Active Protection Service #reverse engineering #SHA_256 Lookup #threat intelligence #Windows Defender
Penetration Testing Tools
Peering into the Cloud: Decode Windows Defender’s MAPS Protocol with the MAPS Cloud Scanner
Interact directly with Microsoft’s MAPS backend. Use this research tool to analyze file reputations, reverse the Bond protocol, and fuzz Defender's cloud API.
17 views
Daily Writeups
⤷ Title: Supply Chain Fallout: LAPSUS$ Leaks 96GB of Stolen Checkmarx Data Following TeamPCP Breach
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:35:39 +0000
════════════════════════
⌗ Tags: #Data Leak #Checkmarx #CVE_2026_33634 #data leak #GitHub Breach #KICS #LAPSUS$ #Mandiant #Open VSX #supply chain attack #TeamPCP #Trivy #VS Code extensions
Penetration Testing Tools
Supply Chain Fallout: LAPSUS$ Leaks 96GB of Stolen Checkmarx Data Following TeamPCP Breach
Checkmarx is grappling with a distressing sequel to its March security breach, as data exfiltrated from a private
11 views
Daily Writeups
⤷ Title: The “Snow” Storm: How UNC6692 Uses Microsoft Teams and Email Bombing to Breach Corporate Fortresses
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:34:13 +0000
════════════════════════
⌗ Tags: #Cybercriminals #browser extension malware #Credential Harvesting #Cyber Security 2026 #Email Bombing #Google Threat Intelligence #Mandiant #Microsoft Teams phishing #SnowBasin #SnowBelt #SnowGlaze #Social Engineering #UNC6692
Penetration Testing Tools
The "Snow" Storm: How UNC6692 Uses Microsoft Teams and Email Bombing to Breach Corporate Fortresses
Corporate correspondence has once again emerged as a convenient portal for adversaries. In this nascent campaign, the assailants
7 views
Daily Writeups
⤷ Title: The Trojan Update: How “GlassWorm” Developers are Using Sleeper Extensions to Hijack Workspaces
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:32:31 +0000
════════════════════════
⌗ Tags: #Malware #Cyber Espionage #Developer Security #extension security #GlassWorm #malware #OpenVSX #Socket #supply chain attack #Trojan Update #Visual Studio Code #VS Code
Penetration Testing Tools
The Trojan Update: How "GlassWorm" Developers are Using Sleeper Extensions to Hijack Workspaces
The GlassWorm campaign has resurfaced within the developer community, though the adversaries have adopted a more surreptitious operational
4 views
Daily Writeups
⤷ Title: The Poisoned Pipeline: How a GitHub Actions Flaw Infiltrated the Popular “Elementary-Data” Library
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:30:10 +0000
════════════════════════
⌗ Tags: #Malware #2026 Tech News #cloud security #Credential Stealer #Data Engineering #dbt #Docker #Elementary_data #GitHub Actions #GITHUB_TOKEN #PyPI #Python Security #supply chain attack
Penetration Testing Tools
The Poisoned Pipeline: How a GitHub Actions Flaw Infiltrated the Popular "Elementary-Data" Library
The ubiquitous Python library elementary-data has emerged as a conduit for the exfiltration of sensitive developer telemetry. The
4 views
Daily Writeups
⤷ Title: The PDF Trap: How the Anatsa Banking Trojan Infiltrated Google Play’s Top 200 Tools
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:26:56 +0000
════════════════════════
⌗ Tags: #Malware #Anatsa #Android malware #banking trojan #Cyber Espionage #Dropper App #Google Play Store #HEUR:Trojan_Downloader.AndroidOS.Anatsa.a #kaspersky #mobile security #Russian Cyber Threats
Penetration Testing Tools
The PDF Trap: How the Anatsa Banking Trojan Infiltrated Google Play’s Top 200 Tools
A clandestine Android dropper, masquerading as a mundane PDF reader, has once again infiltrated the Google Play Store.
5 views
Daily Writeups
⤷ Title: The $1.5M Purrlend Heist: Cross-Chain Chaos Signals a Brutal $800M Month for DeFi Security
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:23:34 +0000
════════════════════════
⌗ Tags: #Cybercriminals #2026 Crypto Trends #Cross_Chain Bridge #Crypto Security #DeFi Hack #Drift Protocol #HyperEVM #KelpDAO #Lazarus Group #MegaETH #NTLM Coercion #Purrlend #Smart Contract Audit
Penetration Testing Tools
The $1.5M Purrlend Heist: Cross-Chain Chaos Signals a Brutal $800M Month for DeFi Security
The cryptocurrency landscape has received yet another ominous signal as adversaries successfully breached yet another DeFi platform, leaving
9 views
Daily Writeups
⤷ Title: OpenAI’s GPT and Codex Models Officially Join Amazon Bedrock
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 08:30:27 +0000
════════════════════════
⌗ Tags: #Technology #Agentic AI #AI Agents #Amazon Bedrock #AWS #Cloud Computing #Codex #DevSecOps #enterprise AI #GPT_4 #machine_learning #OpenAI
Daily CyberSecurity
OpenAI’s GPT and Codex Models Officially Join Amazon Bedrock
AWS and OpenAI expand their alliance, bringing GPT models, Codex, and managed AI agents to Amazon Bedrock with enterprise-grade security and consolidated billing.
11 views
Daily Writeups
⤷ Title: AWS Launches “Amazon Quick” to Bridge the Gap Between Desktop and Cloud
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 08:06:58 +0000
════════════════════════
⌗ Tags: #Technology #Agentic AI #AI Desktop Assistant #Amazon Quick #AWS #Enterprise Productivity #Generative AI 2026 #Google Workspace #Long_Term Memory #Microsoft 365 #Multi_Platform Integration #Salesforce #Slack
Daily CyberSecurity
AWS Launches "Amazon Quick" to Bridge the Gap Between Desktop and Cloud
AWS unveils Amazon Quick, a "borderless" desktop AI assistant with long-term memory. It integrates local files with Slack, Teams, and Salesforce for proactive work.
12 views
Daily Writeups
⤷ Title: iOS 27 and Google Gemini are Turning the iPhone into an AI Powerhouse
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:45:49 +0000
════════════════════════
⌗ Tags: #Technology #Apple Intelligence #Apple Photos #Computational Photography #Generative AI #Google Gemini #iOS 27 #iPhone AI #Siri 2.0 #Spatial Photos #Vision Pro #WWDC 2026
Daily CyberSecurity
iOS 27 and Google Gemini are Turning the iPhone into an AI Powerhouse
Apple’s iOS 27 leaks reveal a massive AI pivot: a Gemini-powered Siri App and generative "Extend" and "Reframe" tools to rival Google’s Magic Editor.
9 views
Daily Writeups
⤷ Title: Silicon Valley’s Martial Pivot: Google Cedes “Veto Power” to the Pentagon in Classified AI Pact
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:06:28 +0000
════════════════════════
⌗ Tags: #Technology #2026 Tech News #AI Ethics #Anthropic #Department of Defense #Gemini AI #google #Military AI #national security #OpenAI #Pentagon #Project Maven 2.0 #Sundar Pichai #Trump Administration #xAI
Daily CyberSecurity
Silicon Valley’s Martial Pivot: Google Cedes "Veto Power" to the Pentagon in Classified AI Pact
Google signs a secret deal with the Pentagon, allowing Gemini AI use for "any lawful purpose." With no veto power, 600 employees revolt over ethics and safety.
12 views
Daily Writeups
⤷ Title: Tall Tales: China’s Private Contractors and the Global Hunt for Dissent
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:03:33 +0000
════════════════════════
⌗ Tags: #Cyber Security #china #Citizen Lab #cyber_espionage #Digital Transnational Repression #DTR #GLITTER CARP #Human Rights #ICIJ #Military_Civil Fusion #phishing #Scilla Alecci #SEQUIN CARP #social engineering
Daily CyberSecurity
Tall Tales: China’s Private Contractors and the Global Hunt for Dissent
Citizen Lab reveals "Tall Tales," a PRC campaign using GLITTER CARP and SEQUIN CARP to hunt activists and ICIJ journalists via private contractors.
6 views
Daily Writeups
⤷ Title: Amazon Connect Reinvents the Enterprise as an AI-Powered “Operating Brain”
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:03:10 +0000
════════════════════════
⌗ Tags: #Technology #Agent_as_a_Service #Agentic AI #AI Recruitment #Amazon Connect #Amazon Connect Health #AWS #Enterprise Automation #Generative AI #Humorphism #Supply Chain Optimization
Daily CyberSecurity
Amazon Connect Reinvents the Enterprise as an AI-Powered "Operating Brain"
Amazon Connect evolves into a suite of Agentic AI solutions for supply chain, hiring, and health. Discover how AWS is leading the shift to Agent-as-a-Service.
9 views
Daily Writeups
⤷ Title: ⚙️ 08. — JWT authentication bypass via algorithm confusion with no exposed key
════════════════════════
𐀪 Author: The4v1
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 08:21:01 GMT
════════════════════════
⌗ Tags: #portswigger #bug_bounty #web_security #cybersecurity
Medium
⚙️ 08. — JWT authentication bypass via algorithm confusion with no exposed key
Difficulty: 🔴 Expert
13 views
Daily Writeups
⤷ Title: ⚙️ 07. — JWT authentication bypass via algorithm confusion
════════════════════════
𐀪 Author: The4v1
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 08:11:01 GMT
════════════════════════
⌗ Tags: #bug_bounty #portswigger #cybersecurity #web_security
Medium
⚙️ 07. — JWT authentication bypass via algorithm confusion
Difficulty: 🔴 Expert
7 views
Daily Writeups
⤷ Title: ⚙️ 06. — JWT Authentication Bypass via kid Header Path Traversal
════════════════════════
𐀪 Author: The4v1
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 08:01:02 GMT
════════════════════════
⌗ Tags: #portswigger #bug_bounty #web_security #cybersecurity
Medium
⚙️ 06. — JWT Authentication Bypass via kid Header Path Traversal
Difficulty: 🟡 Practitioner
11 views
Daily Writeups
⤷ Title: ⚙️ 05. — JWT Authentication Bypass via JKU Header Injection
════════════════════════
𐀪 Author: The4v1
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:51:01 GMT
════════════════════════
⌗ Tags: #cybersecurity #web_security #bug_bounty #portswigger
Medium
⚙️ 05. — JWT Authentication Bypass via JKU Header Injection
Difficulty: 🟡 Practitioner
7 views
Daily Writeups
⤷ Title: ⚙️ 04. — JWT Authentication Bypass via JWK Header Injection
════════════════════════
𐀪 Author: The4v1
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:41:01 GMT
════════════════════════
⌗ Tags: #portswigger #bug_bounty #web_security #cybersecurity
Medium
⚙️ 04. — JWT Authentication Bypass via JWK Header Injection
Difficulty: 🟡 Practitioner
7 views
Daily Writeups
⤷ Title: ⚙️ 03. — JWT Authentication Bypass via Weak Signing Key
════════════════════════
𐀪 Author: The4v1
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:31:01 GMT
════════════════════════
⌗ Tags: #web_security #portswigger #cybersecurity #bug_bounty
Medium
⚙️ 03. — JWT Authentication Bypass via Weak Signing Key
Difficulty: 🟡 Practitioner
7 views
Daily Writeups
⤷ Title: ⚙️ 02. — JWT Authentication Bypass via Flawed Signature Verification
════════════════════════
𐀪 Author: The4v1
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:21:01 GMT
════════════════════════
⌗ Tags: #web_security #cybersecurity #portswigger #bug_bounty
Medium
⚙️ 02. — JWT Authentication Bypass via Flawed Signature Verification
Difficulty: 🟢 Apprentice
5 views
Daily Writeups
⤷ Title: ⚙️ 01. — JWT Authentication Bypass via Unverified Signature
════════════════════════
𐀪 Author: The4v1
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 07:11:01 GMT
════════════════════════
⌗ Tags: #web_security #bug_bounty #portswigger #cybersecurity
Medium
⚙️ 01. — JWT Authentication Bypass via Unverified Signature
Difficulty: 🟢 Apprentice
5 views