Cory DoctorowA pretty clever phishing email: I got a message warning me that my Twitter account was about to be suspended for suspicious activity, inviting me to click a button to prevent this. The URL the button went to *was* an x.com link, but it used a security vulnerability in Twitter's backend that allowed redirections to push me to an OATH server that would prompt me for my Twitter login and 2FA, and then send the attacker a valid token they could use to take over my account:
Winter TrabexIn either Red Team Blues or the Bezzle, I don't remember which, Hench was thinking about security vulnerabilities. He said something said, "It's better if the box (the vulnerability) doesn't exist."
In this case, I'd say the vulnerability is you still having an account on Twitter. Nevermind that you hardly post there. The account itself is a risk.
James Bartlett 