iDictPy

iDictPy 不機嫌な100%検証済みハッカーステータスのPythonスクリプト。Apple IDをアップルクリスプに変えるためのものだ nicememe 当初はこのクソみたいな代物のより良い代替品として作った: https://github.com/Pr0x13/iDict/ でもその後、自分が少し酔っ払ってることを忘れて、こんなものが出来上がった。 前提条件は「requests」と「threadpool」。pipかeasyinstallを使用すること。 こいつらは、お前が間違ってると思われない限り、たまには親切だ: http://reddit.com/r/netsec 本当に孤独だ...

ibrute

업데이트 클라우드 저장소 보안에 대해 우려하신다면 내가 클라우드였다면?을 읽고 피드백을 남겨 주세요. 감사합니다. 재미의 끝, Apple이 방금 패치했습니다. 여기 appleID 비밀번호 무차별 대입 p0c가 있습니다. 이것은 p0c일 뿐이므로 다음 기능은 없습니다. MultiThreading멀티스레딩 기능 Save-State-On-Exception예외 시 상태 저장 기능 직접 만들어 보세요. Find My Iphone 서비스 API를 사용하며, 여기에는 무차별 대입 방지 기능이 구현되어 있지 않습니다. 비밀번호 목록은...

ios-gamed-0day

iOS gamed 익스플로잇 15.0.2에서 수정됨 업데이트: Apple은 iOS 15.0.2에서 아무런 공개적인 인정이나 크레딧 없이 조용히 이를 수정했습니다. App Store에서 설치된 모든 앱은 사용자에게 어떤 프롬프트도 없이 다음 데이터에 접근할 수 있습니다: 이와 연결된 Apple ID 이메일 및 전체 이름 사용자를 대신하여 .apple.com의 엔드포인트 중 하나 이상에 접근할 수 있게 해주는 Apple ID 인증 토큰 Core Duet 데이터베이스에 대한 전체 파일 시스템 읽기 접근 Mail, SMS,...

CVE-2026-8457 WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

PT-2026-67342

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id token and decoding only its base64 payload without verifying the JWT signature against Apple...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

CVE-2026-55954 Missing ID token claim validation in ueberauth_apple allows account takeover

Authentication Bypass by Spoofing vulnerability in ueberauth ueberauthapple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback idtoken against Apple's JWKS but does not validate any registered...

Real Apple notifications are being used to drive tech support scams

Scammers have found a way to abuse legitimate Apple account notification emails to trick targets into calling fake tech support numbers. According to a report from BleepingComputer, scammers create an Apple account and insert a phishing message into the personal information fields, then modify th...

CVE-2026-31813 Supabase Auth has insecure Apple and Azure authentication with ID tokens

Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a...

Apple Pay phish uses fake support calls to steal payment details

It started with an email that looked boringly familiar: Apple logo, a clean layout, and a subject line designed to make the target’s stomach drop. The message claimed Apple has stopped a high‑value Apple Pay charge at an Apple Store, complete with a case ID, timestamp, and a warning that the...

Stolen iPhones are locked tight, until scammers phish your Apple ID credentials

One of the reassuring things about owning an iPhone was knowing you could lock it if it got lost or stolen. Without your passcode, fingerprint or face to unlock it, it would be useless to anyone else. Now, though, some phone thieves have found a workaround, not by breaking Apple's security, but b...

EUVD-2020-30625

Malware in sbrugna...

EUVD-2021-17815

Malware in sbrugna...

EUVD-2014-4426

Malware in sbrugna...

EUVD-2018-16110

Malware in sbrugna...

EUVD-2017-16176

Malware in sbrugna...

EUVD-2021-17911

Malware in sbrugna...

EUVD-2017-11580

Malware in sbrugna...

A week in security (July 28 &#8211; August 3)

Last week on Malwarebytes Labs: Apple ID scam leads to $27,000 in-person theft of Ohio man OpenAI kills "short-lived experiment" where ChatGPT chats could be found on Google Trump Administration and Big Tech want you to share your health data Prison visitor details shared with all inmates at...

Apple ID scam leads to $27,000 in-person theft of Ohio man

You've probably heard about people scamming from halfway around the world, but sometimes they turn up at your door. That's what happened in May, when 67 year-old Robert Wise of Ohio received a text telling him that his Apple ID had been compromised. It had been used at an Apple store for a $213...