EvilApp - Phishing Attack Using An Android App To Grab Session Cookies For Any Website (ByPass 2FA)

Man-in-the-middle phishing attack using an Android app to grab session cookies for any website, which in turn allows to bypass 2-factor authentication protection. EvilApp brings as an example the hijacking and injection of cookies for authenticated instagram sessions. Legal disclaimer: Usage of...

Locator - Geolocator, Ip Tracker, Device Info By URL (Serveo And Ngrok)

Geolocator, Ip Tracker, Device Info by URL Serveo and Ngrok. It uses tinyurl to obfuscate the Serveo link. Legal disclaimer: Usage of Locator for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws...

Hidden-Cry - Windows Crypter/Decrypter Generator With AES 256 Bits Key

Windows Crypter/Decrypter Generator with AES 256 bits key Features: Works on WAN: Port Forwarding by Serveo.net Fully Undetectable FUD - Don't Upload to virustotal.com! Legal disclaimer: Usage of Hidden-Cry for attacking targets without prior mutual consent is illegal. It's the end user's...

How to Set Your Facebook, Twitter, and Instagram to Control Who Sees What

Pick who sees your tweets, posts, and stories—and choose what you want to see, too...

Facebook Instagram for Android Input Verification Error Vulnerability

Facebook Instagram for Android is an Android-based social networking application that provides online photo and video sharing. An input validation error vulnerability exists in versions prior to Facebook Instagram for Android 128.0.0.26.128. The vulnerability stems from a network system or produc...

CVE-2020-1895

A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128...

CVE-2020-1895

A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128...

Heap overflow

A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128...

CVE-2020-1895

A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128...

CVE-2020-1895

CVE-2020-1895 affects Instagram for Android prior to version 128.0.0.26.128, due to a large heap overflow when uploading specially crafted images. The issue originates in image parsing code (MozJPEG integration) that mishandles dimensions, enabling memory corruption. Public references describe re...

PT-2020-15151

Name of the Vulnerable Software and Affected Versions Instagram for Android versions prior to 128.0.0.26.128 Description A large heap overflow could occur when attempting to upload an image with specially crafted dimensions. This issue could have allowed remote attackers to take control over...

CVE-2020-1895: Integer Overflow to Buffer Overflow

A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128...

InstaSave - Python Script To Download Images, Videos & Profile Pictures From Instagram

InstaSave is a python script to download images, videos & profile pictures from Instagram without any API access. Features Download Instagram Photos Download Instagram Videos Download Instagram Profile Pictures Git Installation clone the repo $ git clone...

Hamas Ensnares Israeli Soldiers with Pretty 'Ladies'

Hamas has been caught taking a classic “catfish” approach, to tempt Israeli soldiers into installing spyware on their phones. Members posed as teen girls who are looking for quality chat time. This is the third time that the Palestinian group has used the tactic – but this time it upped its...

Gustuff return, new features for victims

By Vitor Ventura with contributions from Chris Neal. Executive summary The Gustuff banking trojan is back with new features, months after initially appearing targeting financial institutions in Australia. Cisco Talos first reported on Gustuff in April. Soon after, the actors behind Gustuff starte...

Open Redirect Bug in Bridge Theme Plugin Opens Admins to Spearphishing

Two open-redirect vulnerabilities in Bridge, a commercial WordPress theme purchased more than 120,000 times, would allow an attacker to mount spearphishing attacks against site administrators. An open redirect vulnerability can be used to hide malicious links behind URLs for legitimate domains. F...

Gustuff Android Banker Switches Up Technical Approach

An Instagram-initiated campaign using the Gustuff Android mobile banking trojan has rolled out in October, featuring an updated version of the malware that lowers its detection profile. How the cybercriminals are rolling out the campaign is the same as a previous offensive seen in June, according...

A week in security (October 14 – 20)

Last week on Malwarebytes Labs, we tried to unlock the future of the password its vulnerabilities, current alternatives, and possible future disappearance, analyzed the lagging response by many businesses in adopting a patch for Pulse VPN vulnerability, looked at Instagram’s bulked-up security...

How to Control the Privacy of Your Facebook, Instagram, Twitter, and Snapchat Posts

Whether it's Facebook, Instagram, Twitter, or Snapchat, lock down who can see what you're up to...

Instagram clamps down on fake messages with anti-phishing tool

Instagram accounts will always be a popular target for scammers. You might not think it’s a big deal if someone has their account swiped, but it’s often the vanguard of many online businesses. A takeover, or a deletion, can be absolutely devastating. Smart hacking crews are always in the...