Maltemo

🇫🇷 - Security auditor. In my free time, interested in development, OSINT & Forensic. Eclectic hobbies and interests.

[Antoine Vastel @xopek59]

@Castle_io 's research team just open sourced a disposable email domain list built from real abuse telemetry 🔎

Disposable email providers are a core piece of infrastructure behind fake account creation and signup abuse, similarly to how proxies enable large-scale traffic distribution.

A few things we cared about:
- curated, not aggregated from public lists
- strictly disposable domains
- updated daily
- ranked by observed abuse prevalence

And yes, before someone says it: attackers also use aged Gmail accounts, compromised inboxes, freshly registered domains, etc 😄

Disposable domains are not the whole problem, but they’re still one of the clearest infrastructure-level signals behind large-scale signup abuse.

Repo:
https://t.co/M7nx959KHE

[celeste ➡️ vibecamp 🔜 vibechella @vmfunc]

the watchers: how openai, the US government, and persona have been secretly running an identity surveillance system since nov 2023.

https://t.co/Zz04WDF8Lz

researched by @vmfunc, @MDLcsgo, @DziurwaF

[Laluka@OffenSkill @TheLaluka]

Hoy !
Pas de stream ce soir... MAIS !
Release d'une petite série que j'ai pris plaisir à vivre, tourner, et réaliser sur le travail fait ave d'autres nombreux bénévoles pour @hack_4_values !

On y parle de l'organisation, des enjeux, des ONG évidemment, mais aussi des bugs trouvés, de méthodologie, et de l'aspect HuMaIn ! 💌

Vos partages -très- appréciés, et je vous souhaite une -très- bonne semaine 🌻

https://t.co/NLaqj5auW5

[Maltemo @Maltemo]

@TraceLabs @_leHACK_ Will you still be there tomorrow or is this activity only available today ?

[slonser @slonser_]

My new research
Escalation of Self-XSS to XSS using modern browser capabilities.
https://t.co/aYKhHAeCcq

[Maltemo @Maltemo]

@noraj_rawsec @Zeecka_ "Bisous" 😂

[Toffy @toffyrak]

🔍 New research on a niche technique to abuse "GPP Local Users and Groups" to elevate privileges locally through sAMAccountName hijacking.

This research comes with a new GPOHound update to detect this misconfiguration.

🔗 Read more: https://t.co/bE3rEEJNfT

[Laluka@OffenSkill @TheLaluka]

Documenté, Sourcé, Miniaturé, Plus qu'à... Siroter ! 🎁
Cc @Maltemo 🤝 @KharaTheOne

https://t.co/dUvD8C124a

[Laluka@OffenSkill @TheLaluka]

Blip @Maltemo Bloup @KharaTheOne Boum 💣️
https://t.co/WANxEdDCPc

[Toffy @toffyrak]

I have just released my first tool : GPOHound 🚀

GPOHound is an offensive tool for dumping and analysing GPOs. It leverages BloodHound data and enriches it with insights extracted from the analysis.

🔗Check it out here: https://t.co/bMiOK8jiTE

[slonser @slonser_]

I think many people are familiar with the topic of blind CSS exfiltration, especially after the post by
@garethheyes
However, an important update has occurred since then, which I wrote below ->

[Mayfly @M4yFly]

New Active Directory Mindmap v2025.03! 🚀

📖 Readable version: https://t.co/gQd6WsLnzG

🔧 Now fully generated from markdown files—way easier to update and maintain!

💡 Got improvements? PRs welcome! 👉 https://t.co/o52PAmek7b

[Laluka@OffenSkill @TheLaluka]

Hi it's me again, I've been calling for a while now, you need to pay your health insurance Sir...
Or have some replays? 😏

La dernière Techno Watch avec @Drypaints @Maltemo et @pentest_swissky !🌿

FYI: Pas de stream ce mardi 4 Fev ➡️ HTB Meetup Lyon !
Rdv au Elephant and Castle, début à 19h+ et miniconfs à ~20h ! 😘

https://t.co/z9NJNEHdE1

[Laluka@OffenSkill @TheLaluka]

Yop ! 🌿
Reprise des veilles technos ce soir 21h ! 🌖
En compagnie de @Drypaints @Maltemo @pentest_swissky 😎

~ See you there ~
https://t.co/WANxEdEaEK

[Maltemo @Maltemo]

Just discovered this nice resource about DOM Clobbering attacks :
https://t.co/Vr3Ccx5tCM

Thank you @Soheil__K for this amazing work

[Maltemo @Maltemo]

@navlys__ @Haax9_ yep je m'en servais de temps en temps, il était bien utile.
Après tu peux toujours le laisser en dépôt git, ça ne me pose pas de problèmes :)

[Maltemo @Maltemo]

@TheLaluka 👉👈

[Maltemo @Maltemo]

EKUwu vulnerability was just patched by Microsoft.

A security update is available : https://t.co/4iCi1KlOpd

https://t.co/UF6eM0RksG

[TrustedSec @TrustedSec]

⚠️ NEW UPDATE: In October, @Bandrel wrote about a vulnerability he discovered called #EKUwu. This vulnerability was patched on November 12. Find more information about EKUwu and the link to the patch on our blog! https://t.co/bBro2A8WlY

[Ambionics Security @ambionics]

We're proud to announce LIGHTYEAR, a tool that let you dump files, blind, in PHP, based on a new algorithm.
https://t.co/GG4tSNnUCf

[Maltemo @Maltemo]

Just recieved legal policies’ update by mail.
« **For the moment**, we don’t activate IA training on European countries ».

FOR THE MOMENT

Note that Strava already does that on your medical data and doesn’t even let you opt out.

GrEaT ��

[Maltemo @Maltemo]

Not suprised, but this will happen with increasing frequency.
Fortunately, Europe, UK and Switzerland were spared.
Nothing is free.
https://t.co/qPohCR4UpJ

[Tuta @TutaPrivacy]

🔴 Alert 🔴 LinkedIn is using your data to train its generative AI by default.

No, you didn’t opt in. LinkedIn did it for you! 🙈

Here’s how you can stop LinkedIn from using your data 👉 https://t.co/vCYIgfDYWH