I'm currently dealing with an incredibly frustrating situation on YesWeHack and looking for advice, as the platform's mediation team has completely ghosted me.

Situation: I submitted a Critical vulnerability (Global Account Takeover via Insecure TLS Validation) 6 months ago. The vendor accepted it at CVSS 9.6 (Critical). However, they only paid me out for the "High" tier (shortchanging the "Critical" tier by nearly 60%). Furthermore, they explicitly promised me in writing that I would be credited on the CVE. Fast forward: a CVE is published for this exact issue/component, but credited to a notable and famous third party. The vendor ghosted me.

CVSS Manipulation: 1.5 months ago, I finally got YesWeHack support to poke the vendor. The vendor's response? They retroactively downgraded my CVSS from 9.6 to 8.2 (changing an automated Wi-Fi MitM from Adjacent/Low Complexity to Local/High Complexity) solely to justify their underpayment.

Ghosting: I escalated this clear CVSS manipulation and matrix abuse to YesWeHack Support on July 7th. No reply. I sent a harsh follow-up on August 8th. Still absolutely no reply. It's August 20th.

On top of this, the same vendor closed another 9.9 architectural E2EE flaw as "Won't Fix" (a silent security downgrade where the app drops E2EE and uploads plaintext media to their cloud without user warning) just to avoid another payout.

Is it normal for YWH to let vendors retroactively manipulate vectors to dodge payouts and then ghost researchers who ask for mediation? Who can I contact to escalate this past the Tier 1 support desk?

As a layman, I would like to know if it is theoretically possible (I know it is illegal) to access a phone without physically having it in hand. Or if it is possible to hack someone's account without them finding out (assuming they have two-factor authentication).

I’m trying to figure out what’s happening because this all started really suddenly and I’m honestly confused.

The first thing that happened was about 2 days ago. Out of nowhere, I started getting a huge amount of random text messages from different companies/services.

A lot of them were verification codes, sign-up messages, or things from companies I don’t even remember using. It looked like an SMS bomb.

After the SMS bomb, someone tried to order a GPU through my Amazon account. Amazon caught it and cancelled the order. That was the first time I realized someone might actually have access to one of my accounts rather than this just being random spam.

Then, after the attempted GPU purchase, I started noticing people trying to log into basically everything. I started getting login/security alerts across multiple accounts, and my Microsoft account ended up being compromised.

The Microsoft situation has been especially stressful because I no longer have access to the old phone number on the account, and when I tried to update the recovery/security information, Microsoft said it can take around a month for the security information to update. I already talked to Microsoft support, but they basically told me they can’t bypass that process.

I also ran Microsoft Defender on my Windows 11 PC because I was worried I might have malware. It detected a threat, but it says the threat was blocked. I’m still doing scans/checking the computer because I don’t know if that’s what caused all of this or if my information was leaked somewhere else.

Then today something even weirder happened. I opened ChatGPT and there was a conversation/message in Russian that I absolutely did not send. The message was a completely coherent question about having a game and wanting to use AI to turn game artwork into animations/video assets. I don’t speak Russian and I have no reason to ask anything like that.
I immediately changed my ChatGPT password, logged out of all sessions, and enabled 2FA.

Also, someone messaged my boyfriend on Instagram today with a strange message about me, supposedly from India, and I have no idea if that’s related or not.

I genuinely don’t know what to do. I am not that good with computers and this has never happened to me before.

Timeline:
● 2 days ago: sudden SMS bomb with tons of random company/verification texts
● After the SMS bomb: someone tried ordering a GPU through my Amazon account, but Amazon caught and cancelled it
● After the GPU attempt: login attempts started happening across multiple accounts
● Microsoft account was compromised
● Windows Defender detected and blocked a threat
● Today: a Russian ChatGPT prompt appeared that I did not send
● Today: suspicious Instagram message sent to my boyfriend from an unknown account/location

I’m changing passwords, enabling 2FA, securing my email, checking account sessions/recovery info, and scanning my PC.
Has anyone seen something like this before? Does the order of events point to anything specific?

I’m wondering if someone got access to my email/passwords, if my information came from a data breach, or if this could be something like an infostealer/session-cookie malware on my computer.

Also, could the SMS bomb have been meant to hide the Amazon purchase attempt or some other important security alert in all the spam?

At this point I’m mainly trying to figure out what I should check next to make sure whoever is doing this no longer has access to anything.

Recently my brother's social media account got hacked and even his account was sending same message to everyone, yesterday night my brother logged in to my pc with his Gmail and the next day my account was hacked too , so I started to investigate and checked all google account in my pc and i found a suspicious web extension in my brothers gmail account, it said free vpn somthing and I know that it is the main culprit it mostly stole my cookie or did csrf , but i wanna know more about what happened can anyone please give me more details what happened behind the scenes

So not so long ago (two months or so) my ps account got deactivated out of nowhere, i know the account adress and the password but it refuses to sign me in, telling me to wait or change my password. Problem is this account is old, and the email password is lost so i can't get into the gmail they send me thus can't change the password, i tried contacting customer support but nothing worked so my question is, is there a way to get it back? A subreddit to go to or a person that can help? Idk where to go except here (sry for the bad English and thanks for paying attention to my problem)

Somebody has scammed me and I need a hacker to get his info. So are there people here who would want to help? For fun or for money? Will there be hackers who do it for pure fun ? It’s a legit cause, if you need proofs i can send it.

I'm not asking for help to hack a group, neither this is a post asking for help to recover my group or account; My group was the target of an attack, where an individual entered the group, was promoted to administrator out of nowhere (it wasn't me), and started removing the other administrators and posting hundreds of videos and images of pornography. I've already recovered the group because, since I created it, I can't be removed.

I just have one question: Was it one of my admins who promoted him, or is there some known exploit he could have used to hack the group?

I'm trying to discover if one of my admins made this, or it was an hacker hacking the invitation link.

Hey everyone, I haven't landed my first tech role but I know it's coming. I have the CompTIA A+ and my mentor told me I could get a datacenter job. I want to be an all around IT specialist meaning I want to configure and troubleshoot hardware, cabling, etc. My main goal is to become a network admin for a big environment like a school, or big company. I am really interested in security, operating systems, privacy, anonymity. I'm going to be doing a home Lab where I create a Home Network with a super hardened surface. My main goal is to learn how to create a from the bottom up, like a domain, create emails using spam filter, configure accounts permission's, workgroups etc. and make them completely hardened. So I mean like using Tacacs+ on all equipment, 802.1x WPA , with only certificates for authorized individuals, MDM, etc. I want to set up, configure the hardware, configure the domains, accounts, network security like secure dns, internet proxies like the cisco web appliance, Vpns, network segmentation for no single point of failure etc.

What certification should I get next and what route should I take to become this.

Hi all,

This might seem like an air-headed post to most (sorry), but I am genuinely so confused about a scam going around in my area.

A hacker gets into someone’s account and messages their friends asking to send them a link to get into the other account. However, i don’t understand the benefit hackers get from logging into other accounts to do the exact same thing? Is it for the phone numbers and emails? Or is there more to it?