Loading story…
A publicly accessible Google Group under the openssl.org domain let a researcher receive verification messages and authenticate to a community portal as an official OpenSSL.org email identity. OpenSSL was notified and promptly corrected the group configuration. Broader testing using Go-based reconnaissance tooling identified more than 150 publicly readable or writable Google Groups, though membership, moderation, spam filtering, and other controls limited exploitability for many of them.
The issue revives the Ticket Trick technique, in which attackers abuse helpdesk, mailing-list, or issue-tracker email workflows to intercept password-reset links, magic links, or one-time codes issued to a trusted corporate-domain address. Earlier research found the technique could expose internal collaboration platforms, support tickets, social-media accounts, and privileged services through flawed email verification and SSO integrations involving platforms such as GitLab, Zendesk, and Kayako. Organizations should eliminate public or unnecessary external access to domain-associated groups and avoid treating email OTPs or magic links as proof of organizational identity; federated authentication using OIDC or SAML provides stronger assurance.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
The researcher reported the OpenSSL.org Google Group misconfiguration, and the OpenSSL team promptly corrected the configuration.
A researcher found that a misconfigured OpenSSL.org Google Group allowed authentication to a mail-OTP community portal as an official openssl.org email address.
Inti De Ceukelaire published research describing Ticket Trick, an attack method that abused helpdesk and issue-tracker email workflows to capture verification or password-reset messages and access organizational accounts.
De Ceukelaire reported joining eight unauthorized Slack channels used by 332 employees at a large payment processing company and receiving a $5,000 bounty for the finding.
After being informed of the broader helpdesk-abuse issue, Slack changed its no-reply email address to include a random token, mitigating a portion of the Ticket Trick workflow.
Kayako and Zendesk fixed the reported bypass issues; De Ceukelaire said the vendors awarded bug bounties of $1,000 and $750 respectively.
De Ceukelaire reported email-verification bypass flaws in common Kayako and Zendesk configurations through responsible-disclosure channels.
Following the report, GitLab made its Slack workspace invite-only, took additional mitigation steps, and updated documentation warning about risks from company-domain email integrations.
Inti De Ceukelaire used a GitLab issue-creation email address to receive a Slack verification email and join GitLab's internal Slack team, demonstrating the Ticket Trick technique.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A researcher disclosed a **Google identity provider** vulnerability that allowed account takeover through the OAuth 2.0 Device Authorization Grant (`RFC 8628`). The issue reportedly stemmed from two flaws in Google's implementation: a device authorization session could be transferred across browsers using a copied challenge URL, and the authorization server did not ensure that the `client_id` and requested scopes in the later consent step matched those originally tied to the issued `device_code`. The write-up describes the bug as a **confused deputy** condition that let attackers hijack device-code sign-in flows and obtain tokens for arbitrary Google-registered clients. By combining those weaknesses with `prompt=none`, an attacker could allegedly send a single link to a victim already signed in with Google and trigger silent token issuance without a consent screen, fresh 2FA challenge, or obvious account-activity warning. The researcher said the attack could move beyond limited scopes such as YouTube TV and be escalated to **Google Cloud** permissions and even **Gmail** access through IMAP XOAUTH2 when a substituted client was permitted to request `https://mail.google.com`. According to the disclosure, the bug was reported to Google through its VRP, initially rejected, later reopened, fixed, and ultimately awarded a **$13,337** bounty.
Jul 17, 2026
Group-IB reported on a phishing operation tracked as **GTFire** that abuses trusted Google services to reduce suspicion and bypass security controls. The campaign uses legitimate Google infrastructure as part of its delivery or redirection chain, allowing phishing content and lures to blend in with normal enterprise traffic and making detection more difficult for defenders. The activity highlights a broader attacker tactic of hiding malicious workflows behind reputable cloud platforms that users and security tools often implicitly trust. For CISOs and security teams, the incident underscores the need to inspect links and redirects involving trusted SaaS domains, strengthen phishing-resistant authentication, and tune email and web defenses to detect abuse of legitimate services rather than relying solely on domain reputation.
Jun 29, 2026
A series of security research articles and reports have highlighted critical vulnerabilities in web application authentication and account management processes, leading to account takeover (ATO) risks. One researcher discovered an insecure email verification flow in a self-hosted program, where changing the account email and then using a previously issued password reset link allowed an attacker to reset the password for the new email address, effectively taking over the account. This flaw was reported and resulted in a medium-severity bug bounty, demonstrating the real-world impact of improper session and token management during email changes. Another case involved a fintech startup where password reset emails were sent over HTTP instead of HTTPS, exposing the reset token to interception by attackers on insecure networks. This seemingly minor oversight could allow attackers to hijack any account by capturing the token, underscoring the importance of secure transmission for authentication links. Additionally, a common SSO misconfiguration was identified, where the identity provider failed to verify email ownership, enabling users from one organization to access data from another simply by sharing the same email address. This logic flaw in SSO implementation could result in complete account compromise across organizational boundaries. The technical details of these attacks reveal that vulnerabilities often stem from overlooked aspects of authentication flows, such as improper invalidation of tokens, insecure communication channels, and misconfigured trust relationships in SSO. The impact of these flaws is significant, as they can lead to unauthorized access, data breaches, and loss of user trust. Security researchers emphasize the need for rigorous testing of authentication and authorization mechanisms, including manual testing and review of edge cases like email changes and SSO integrations. The response from affected organizations has included prompt acknowledgment and remediation of reported issues, with some awarding bounties to the researchers. These incidents serve as a reminder that even well-established security controls like 2FA, SSO, and HTTPS can be undermined by implementation errors. Organizations are advised to review their authentication workflows, ensure all sensitive links are transmitted securely, and validate email ownership at every step. The findings also highlight the value of bug bounty programs and independent security research in uncovering and addressing critical vulnerabilities before they can be exploited by malicious actors.
Jul 1, 2026