credential stuffing
4 posts
Article
Bypassed controls are absent controls
Leanstral 1.5 bypassed CAPTCHA and rate limiting. Those controls score requests, not identity, the only boundary that refuses credential replay.
Article
The camera on the pole has a login screen
Flock cameras are credentialed endpoints inside a trust boundary. The exposure is not surveillance. It is credential stuffing against a standardized fleet.
Article
340 million records, unverified seller
Technical analysis of plausible attack vectors behind the claimed OnlyFans 340M record leak, with detection signatures for each path.
Article
135 Million Records Behind One Perimeter
McGraw Hill's 135 million account exposure proves edtech identity was classified low-risk while attackers priced it as inventory.