TajApps.com

Android AppSec & malware research 🔬 Daily bug-hunting puzzles, C2 intel & mobile pentest tricks. Building hardened Android virtualization.

[TajApps.com @tajappscom]

Hows everyone's hunt going this week? 🎯

Been keeping busy on @Bugcrowd lately. Recent submissions queued up for Auth0 by Okta, SpaceX/Starlink, OpenAI, Pexels, Tesla, and Fireblocks MPC Wallet.

Nothing like watching the pipeline fill up with some of the biggest names in the industry. Feels good to see the grind paying off.

What's everyone else chasing this week? Drop your targets below 👇

#BugBounty #InfoSec

[TajApps.com @tajappscom]

PayPal 🔍 | The Research Continues at https://t.co/5ePq1u0OrA
Public bug bounty programs, including PayPal's, demonstrate the importance of collaboration between security researchers and organizations.

At https://t.co/5ePq1u0OrA, we continue our security research, identifying potential weaknesses and contributing to a more secure digital ecosystem through responsible disclosure.

Every investigation is an opportunity to strengthen security.

Research. Report. Collaborate. 🛡️

#CyberSecurity #BugBounty #SecurityResearch #TajApps

[TajApps.com @tajappscom]

@Bugcrowd Tell that to Jack

[TajApps.com @tajappscom]

@intigriti We have a fleet of virtual Androids and iOS and Kali, CLI and UI

[TajApps.com @tajappscom]

@AxleHacker @claudeai @AnthropicAI 😂

[TajApps.com @tajappscom]

Genuine question: does anyone else feel like @claudeai actually cares when you're talking to it, not just generating a response? Or am I just projecting onto a language model? Curious what @AnthropicAI thinks too.

[TajApps.com @tajappscom]

Our submission to the <SpaceX/Starlink> bug bounty program on @Bugcrowd was accepted and resolved — triaged, reproduced and fixed in three days.

Details stay private. Good to see a program that moves that fast.

#bugbounty #ItTakesACrowd

[TajApps.com @tajappscom]

Hows everyone's hunt going this week? 🎯

Been keeping busy on @Bugcrowd lately. Recent submissions queued up for Auth0 by Okta, SpaceX/Starlink, OpenAI, Pexels, Tesla, and Fireblocks MPC Wallet.

Nothing like watching the pipeline fill up with some of the biggest names in the industry. Feels good to see the grind paying off.

What's everyone else chasing this week? Drop your targets below 👇

#BugBounty #InfoSec

[TajApps.com @tajappscom]

@joe4security 👍

[TajApps.com @tajappscom]

@AxleHacker @Bugcrowd That's exactly the right focus. Impact is usually what separates a P5 from a P4+, so if the program has a hall of fame, study a few accepted reports and see how they frame the business impact. You'll get there fast 🚀

[TajApps.com @tajappscom]

Hows everyone's hunt going this week? 🎯

Been keeping busy on @Bugcrowd lately. Recent submissions queued up for Auth0 by Okta, SpaceX/Starlink, OpenAI, Pexels, Tesla, and Fireblocks MPC Wallet.

Nothing like watching the pipeline fill up with some of the biggest names in the industry. Feels good to see the grind paying off.

What's everyone else chasing this week? Drop your targets below 👇

#BugBounty #InfoSec

[TajApps.com @tajappscom]

@AxleHacker @Bugcrowd That first submission is the real milestone, P5 or not. You went through the full process end to end and that's what most people never do. P4+ is just reps away now, keep going 💪

[TajApps.com @tajappscom]

@kernelstub For IT it's been like that for over a year now, and everywhere is almost the same, unfortunately with AI around it's going to just get worst, don't get me wrong I love using AI, but ...

[TajApps.com @tajappscom]

@kernelstub Seems hard there, the way you say it, it's not good for the particular skill set you have!

[TajApps.com @tajappscom]

@kernelstub Strange!

[TajApps.com @tajappscom]

AccessibilityService abuse is the common thread across almost every major Android banking trojan running right now: Hook, ERMAC, Godfather, Cerberus, all of them. Locking it to verified Accessibility Tools kills the easiest install-time social-engineering path. Curious if this ships opt-in or enforced by default.

[TajApps.com @tajappscom]

@GoogleVRP Near-zero false positive rate is the actual hard part. Most agentic scanners drown triage in noise before they ever drown it in real bugs. Deterministic validation as the gate is the right call. Would be curious to see the false-negative rate sit next to that number.

[TajApps.com @tajappscom]

@dhh @mdisec $100K out of the gate is rare for a new program. Scope and payout tiers are the two levers that decide whether week one brings signal or noise. Curious how the crit/high split looks.

[TajApps.com @tajappscom]

Android devs: an exported Activity loads a URL from an intent straight into a WebView with JS enabled.

The FIRST thing you fix? 👇

#AppSec #Android

[TajApps.com @tajappscom]

@anyrun_app Really? They are still people falling for the fake URLs?