@winhelpwin Dots "." are treated as a sorta invisible character to the Gmail parsing system, so warriorsFan[at]gmail[dot]com with 1 or more "."s anywhere in the "warriorsFan" portion will be ignored and still forwarded to the original email
English
Abdel
1.8K posts
Abdel
@rockkdev
cto @cubbylaw, prev. edge security @vercel
Los Angeles Joined Temmuz 2015
266 Following1.4K Followers
@rockkdev Sorry if this is a dumb question but can you elaborate what (1) means? If my email is warriorsFan[at]gmail[dot]com what would the “Gmail dot trick…” be?
English
New Robinhood phishing chain that's kinda beautiful:
1. Attacker creates an RH account using the Gmail dot trick of your email (same inbox, different address)
2. Sets device name to HTML
3. RH's "unrecognized activity" email renders the device name unsanitized (html injection)
The result is a real email from noreply@robinhood.com, DKIM pass, SPF pass, DMARC pass, with a phishing CTA
Just because it's real, doesn't mean it's safe... $HOOD
English
@davidgobaud @RobinhoodApp @twilio @vladtenev There would be no need for the dot trick, then. Everyone I’ve seen who’s gotten this has been to a dot trick address
English
@rockkdev Steps probably wrong. No need to make account. They hacked @RobinhoodApp SendGrid @twilio or somehow got a Robinhood domain confirmed @vladtenev
David Gobaud@davidgobaud
Robinhood's email service SendGrid (not on 𝕏 🤦♂️) @twilio is hacked or somehow verified a robinhood\.com domain sending out phishing emails @RobinhoodApp @AskRobinhood Received: from http://o2\.email.robinhood.com (http://o2\.email.robinhood.com. [50.31.40.73])
English
@linguinelabs Yeah; this is one of those things that seems obvious in retrospect, but honestly really easy to miss as an engineer
English
@bmgentile Yes, HTML injection via the device name. Basically XSS with no scripting, just HTML.
I did check, the URL is a phishing URL, albeit I refrained from linking it.
English
@rockkdev hold on, but when you click the CTA link from the legitimate Robinhood email (which you received for their Gmail account that routes to you)… how can there be an outcome which results in your creds being compromised?
Are they somehow injecting a URL into the email’s CTA..?
English
Abdel retweeted
Day 1! Come say hi if you are in NYC this week! 🏇
Truman Sacks@trumansacks1
Excited to share we’ve raised $2.75M for @CubbyLaw from @LudlowVentures, @SamHinkie, and @PSUMVC. We’re building the first AI teaching assistant for law students, powered by our own legal intelligence model trained on thousands of professors’ syllabi, past exams, outlines, and grading rubrics. Cubby started as a horizontal AI research tool, but when law students began adopting it fast, we went all in. Law school prep is broken: • Curve-based grading • 100+ hrs building outlines • Legacy tools students still pay thousands for Cubby brings it all into one connected workspace: case briefs, outlines, and practice exams, calibrated to how your professor teaches and tests. Law school is our first step toward a new era in legal tech.
English
Excited to be apart of this 🏇
Truman Sacks@trumansacks1
Excited to share we’ve raised $2.75M for @CubbyLaw from @LudlowVentures, @SamHinkie, and @PSUMVC. We’re building the first AI teaching assistant for law students, powered by our own legal intelligence model trained on thousands of professors’ syllabi, past exams, outlines, and grading rubrics. Cubby started as a horizontal AI research tool, but when law students began adopting it fast, we went all in. Law school prep is broken: • Curve-based grading • 100+ hrs building outlines • Legacy tools students still pay thousands for Cubby brings it all into one connected workspace: case briefs, outlines, and practice exams, calibrated to how your professor teaches and tests. Law school is our first step toward a new era in legal tech.
English
@pookybypass 👀 their cold pressed juices and protein smoothies are actually pretty good
English
If you were a kid that:
1/ Jailbroke your phone
2/ Resold sneakers
3/ Dropshipped
4/ Played crypto dice
5/ Sent your iOS UDID to someone
6/ Made a big commerce store
7/ Used Limewire
Like this tweet
What am I missing?
English
Throwback to when I found a bypass to Adidas splash.
It worked because Adidas development team still returned developer cookies on a GET to the staging splash page, even with invalid auth. I'd GET staging, take the hmac, transfer to the live domain, and bypass splash.
English
@B_nnett Yeezy Mafia, Sole Slayer, AIOBot, OG YZYlab, Heatedsneaks refresh bypass, Wrath Adidas (Wrath logo is Adidas upside down), and way, way, way more. Been in the botting game since 16' and sneakers since 15', and I have seen a lot in that time. Way too much to list.
English
