New Robinhood phishing chain that's kinda beautiful: 1. Attacker creates an RH account using the Gmail dot trick of your email (same inbox, different address) 2. Sets device name to HTML 3. RH's "unrecognized activity" email renders the device name unsanitized (html injection) The result is a real email from [email protected], DKIM pass, SPF pass, DMARC pass, with a phishing CTA Just because it's real, doesn't mean it's safe... $HOOD

LA is under appreciated

Childhood dream from 2015 secured

Throwback to when I found a bypass to Adidas splash. It worked because Adidas development team still returned developer cookies on a GET to the staging splash page, even with invalid auth. I'd GET staging, take the hmac, transfer to the live domain, and bypass splash.

Gonna be mine before 20. 🤞🏽

@Kufsi__ @garcon32 @_cheffy

THANK YOU @UNDEFEATEDinc FOR MY FIRST RAFFLE WIN EVER

evidence im better

40 hours of coding a week. already at 3 hrs today (far right bar) and it's 5am. (this is active typing time, doesn't track idling) Don't sleep on @StormeIO ⚡️