Hey all, I found a phishing campaign that uses Zoom's document share flow as the initial trust vector. It forces victims through a fake "bot protection" gate, then shows a Gmail-like login. When someone types credentials, they are pushed out to the attacker over a WebSocket and the backend validates them.

I wrote a hands on guide that shows how leaked webhooks surface as an attack vector; how to find them in the wild; how to craft safe non destructive PoCs; how to harden receivers. Includes curl examples for Slack and Discord; Node.js and Go HMAC verification samples; a disclosure template.

Why this matters

• webhooks are often treated as bearer secrets; leaks are common
• small mistakes in verification or ordering can become business logic bugs
• many real world impacts are serviceable without flashy RCE

What you get in the post

• threat model and scope guidance
• detection rules and SIEM ideas

Read it here: https://blog.himanshuanand.com/posts/2025-09-17-how-to-hack-webhooks/
Notes: do not test endpoints you do not own. follow program scope and responsible disclosure rules.

Happy hunting

With the recent npm/Node.js supply chain incident (phished maintainer, 18 packages briefly shipping crypto-stealing code), I wanted to share a small project:
Typo squat Detective, a 2-3 minute browser game to practice spotting look-alike domains.

It covers:
• Numbers ↔ letters (1 ↔ l, 0 ↔ o)
• Unicode homoglyphs (Cyrillic/Greek lookalikes)
• Punycode (xn--) tricks

Play it here: https://typo.himanshuanand.com/

Curious to hear which tricks fooled you and if you would like more levels/brands.