Mohammad Kaif

Android | API | Web Security Researcher

[Mohammad Kaif @_mkahmad]

Yay! I was rewarded $15,000 bounty from Apple.

Account takeover via App Store 👀

#bugbounty #cybersecurity #pentesting

[PT SWARM @ptswarm]

👨🏻‍💻 Did you know that it’s possible to perform RCE in Internet Explorer via clickjacking? Igor Sak-Sakovsky's (@Psych0tr1a) new article will explain how!

https://t.co/HfVLnuzwAT

[Mohammad Kaif @_mkahmad]

Approved!

[Mohammad Kaif @_mkahmad]

Applied for Claude cyber use case, lets see how much time does it takes to accept the application

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[Zhongquan Li @Guluisacat]

The blog post on my talk "Design-Based Vulnerabilities on macOS： Oops, Not a One-Shot Fix" presented at OffensiveCon2026 : https://t.co/DAqpWVVxDs

[Mohammad Kaif @_mkahmad]

@LiveOverflow Any chance of using Chinese models for evals? Like DeepSeek v4? I think the costs would be much lesser than these small models

[Mohammad Kaif @_mkahmad]

"Bounty awards are determined and paid based on what is demonstrated in the report, not on claims made in the report but not proven with evidence or proof of concept." - Apple Security Team

The POC:

[Mohammad Kaif @_mkahmad]

@one33se7en @Hacker0x01 Congrats!!

[solst/ICE of Astarte @IceSolst]

>use a security tool in CI
get pwnd

>update your dependencies
get pwnd

>do nothing, ignore security
win

[Calif @calif_io]

Reverse engineering Apple’s silent security fixes, by @blacktop__

We grabbed the latest iOS update, and diffed it with ipsw. The diff reveals at least two security-relevant changes that were shipped quietly.

https://t.co/mUt11Qy7ly

[Mohammad Kaif @_mkahmad]

@speedyfriend433 Congrats!

[Mohammad Kaif @_mkahmad]

Woke up to getting acknowledged by Apple!

Apple just pushed an update to fix a vulnerability I reported on Music app.

https://t.co/bqfzPoKk1g

#bugbounty #CyberSecurity #appsec

[Bugscale @bugscale]

If you missed the talk at @1ns0mn1h4ck , our latest blog post is now available for you to explore.

In this post, researchers @Hacker_Chai and @SachaKozma detail their journey to a 1-click RCE exploit on the Samsung S25 phone.

Check it out here: https://t.co/x7mZcFCSR3

[Mandiant (part of Google Cloud) @Mandiant]

Google Threat Intelligence Group has identified DarkSword, a new iOS exploit chain leveraging six zero-day vulnerabilities.

Multiple threat actors are actively using it to deploy malware payloads. Update your devices or enable Lockdown Mode.

👉 https://t.co/9XzL9nogwL

[Mohammad Kaif @_mkahmad]

@0xLupin Congrats!!

[Mohammad Kaif @_mkahmad]

@RuDrAkShacker Thanks, Yash!

[Mohammad Kaif @_mkahmad]

Yay! I was rewarded $15,000 bounty from Apple.

Account takeover via App Store 👀

#bugbounty #cybersecurity #pentesting

[Mohammad Kaif @_mkahmad]

@xpl0itmE 1 click access to App Store Session Cookies

[Mohammad Kaif @_mkahmad]

@L3onid1s Thanks!!

[Mohammad Kaif @_mkahmad]

@speedyfriend433 Thanks!!