Yahoo Email-Stealing Exploit Fetches $700
Summary: An Egyptian hacker using the handle 'TheHell' offered a stored cross-site scripting (XSS) exploit in yahoo.com for $700 on an exclusive cybercrime forum, claiming it steals Yahoo Webmail cookies and works on all browsers without needing to bypass IE or Chrome XSS filters. KrebsOnSecurity alerted Yahoo, and director of security Ramses Martinez said the fix is a simple code change that could be deployed in a few hours once the offending URL is identified from the video.
What's compelling: A working email-hijack exploit priced at $700, against a vendor that pays no bug bounty, means the barrier to stealing a Yahoo inbox is a single purchase and a malicious link a victim has to click.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026