Loading story…
A participant exploited hardcoded Firebase credentials and a misconfigured authentication service in the VaultPass v2 Android app during the KPMG CTF 2025. The attack chain involved reverse engineering the APK, discovering hardcoded API keys, and leveraging anonymous authentication to bypass database security. This allowed full access to protected data, highlighting the risks of improper credential management and cloud misconfigurations in mobile applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
6 references tracked. Mallory keeps watching after this page renders.
infosecwriteups.com
Open sourceinfosecwriteups.com
Open sourceinfosecwriteups.com
Open sourcecyberwoxunplugged.com
Open sourceinfosecwriteups.com
Open sourceinfosecwriteups.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security researcher reverse engineered a Fortune 500 company's Android app and discovered hardcoded AWS keys and API secrets. This vulnerability granted full database access and demonstrated the risks of embedding sensitive credentials in mobile applications. The incident highlights the importance of secure coding practices and regular security reviews for mobile app deployments.
Jun 29, 2026
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026
Cybercriminals are actively exploiting a vulnerability in Fortinet FortiGate firewalls (CVE-2020-12812) that allows them to bypass two-factor authentication (2FA) and gain unauthorized access to VPNs and administrative consoles. The flaw, originally patched in 2020, arises from a case-sensitivity mismatch between FortiGate's handling of usernames and that of LDAP directories, such as Active Directory. Attackers can exploit misconfigured environments where local FortiGate users with 2FA are also members of LDAP groups mapped to authentication policies, enabling them to log in using case-variant usernames and valid LDAP credentials, thereby bypassing 2FA entirely. Fortinet has confirmed that successful exploitation can grant attackers VPN access or elevated privileges without requiring a second authentication factor. The company urges administrators to audit configurations, reset all credentials (including LDAP/AD binding accounts), and review logs for suspicious authentication patterns. Despite the availability of patches since 2020, unpatched or misconfigured devices remain at risk, and opportunistic attackers are actively targeting these systems in the wild.
Jun 29, 2026