r/pwnhub

Hi PWN Community, I'm Hieu Minh Ngo, also known as Hieupc, a cybersecurity specialist from Vietnam and a former black hat hacker. I started hacking as a teenager. 

By my early twenties I was running identity theft services that sold the stolen personal data of nearly 200 million people: names, Social Security numbers, dates of birth, everything needed to steal an identity. 

In 2013 the US Secret Service lured me to Guam with a fake data deal and arrested me the moment I stepped off the plane. I was facing more than 40 years in federal prison, pleaded guilty, and was sentenced to 13 years. 

I served more than 7 years and was deported back to Vietnam in 2020. I decided to spend my second chance fighting the crime I once committed. I worked as a security expert at Vietnam's National Cyber Security Center and founded Chong Lua Dao ("Scam Fighters"), a non-profit that protects people from online scams. 

Most recently, my team collaborated with Infoblox on an investigation that traced an Android banking trojan to the K99 Triumph City scam compound in Sihanoukville, Cambodia. 

We helped rescue trafficking victims who were forced to run scams inside the compound, and the evidence they brought out let us connect specific malware to a physical scam operation for the first time. 

My story and work have been documented in a few places:

• Darknet Diaries, Episode 162: Hieu: https://darknetdiaries.com/episode/162/
• KrebsOnSecurity, "Confessions of an ID Theft Kingpin": https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-i/
• Infoblox, "Scams, Slaves, and Malware-as-a-Service" (the K99 Triumph City investigation): https://www.infoblox.com/blog/threat-intelligence/scams-slaves-and-malware-as-a-service-tracking-a-trojan-to-cambodias-scam-centers/
• TIME, "'A Perfect Storm': How AI Is Transforming the Global Scam Industry": https://time.com/article/2026/04/07/-a-perfect-storm-how-ai-is-transforming-the-global-scam-industry/

I also speak regularly about my story, including a TEDx talk, "The Art of Thinking Like a Cybercriminal", and I post ongoing findings on X: https://x.com/HHieupc Ask me anything about:

• How the identity theft marketplace worked from the inside, and how data on 200 million people ended up for sale
• Getting lured to Guam by the Secret Service, my arrest, and 7 years in US federal prison
• Rebuilding a life and career in cybersecurity after prison and deportation
• The scam compound economy in Southeast Asia: forced labor, pig butchering, and how these operations really run
• The K99 Triumph City investigation and tracing malware to a physical compound
• Chong Lua Dao and how we protect everyday users from scams
• How scammers pick their victims and how you can protect yourself and your family
• Anything else on hacking, identity theft, and life on both sides of the line

I'll be here live on Wednesday, August 26th from 12 PM to 1 PM ET answering your questions in real time.

Feel free to leave questions in advance, and I'll get to them when I go live. Looking forward to your questions.

Microsoft has removed the legacy WMIC command-line utility from Windows 11 24H2 and 25H2 to prevent threat actors from abusing the tool for malicious activities.

Key Points:

• WMIC is removed from Windows 11 24H2, 25H2, and beta builds, ending its availability as a Feature on Demand.
• The tool was frequently abused by malware, ransomware, and attackers to disable security software and delete system backups.
• The underlying Windows Management Instrumentation (WMI) system remains active, but administrators must use PowerShell or other modern tools.
• This action follows a deprecation timeline that began with Windows Server 2012 and Windows 10 21H1.

Microsoft has officially removed the Windows Management Instrumentation Command-line (WMIC) tool from the latest versions of Windows 11, specifically versions 24H2 and 25H2, as well as recent beta builds. This removal is the final step in a deprecation process that started years ago, initially converting WMIC into an optional feature before disabling it by default. The legacy tool is no longer available for installation on new systems, marking a significant shift in how Windows manages system administration commands.

Learn More: Bleeping Computer

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

A threat actor calling themselves “TheHatman” is selling what they claim are massive employee-directory exports taken directly from corporate Microsoft Azure/Entra tenants using compromised credentials.

The claimed numbers are substantial:

• McDonald’s: 1.7M+ records
• TCS: ~800K
• Vodafone: ~425K
• HCL Technologies: ~250K
• IHG: ~185K
• Kyndryl: ~170K
• Gap: ~80K
• Hexaware: ~20K
• Wyndham: ~9K

Important caveat: none of the named companies have publicly confirmed the alleged exposures.

Hudson Rock says the datasets appear highly legitimate based on fields and corporate addresses matching Azure directory exports.

What makes these dumps interesting from an offensive-security perspective isn't just the PII.

The listings allegedly contain organizational intelligence such as:

• Employee names and corporate emails
• Job titles and departments
• Managers and direct reports
• Group memberships
• Service accounts
• Access mappings
• Global Administrator listings

If legitimate, that's basically a ready-made reconnaissance dataset.

Full research and claimed dataset breakdown:
https://www.technadu.com/thehatman-is-selling-millions-of-stolen-employee-records-from-mcdonalds-vodafone-tata-wyndham/633410/

An attacker could potentially identify executives, IT personnel, administrators, service accounts, reporting relationships, and other high-value identities before launching phishing, credential attacks, help-desk social engineering, or lateral access attempts.

The initial access method is not confirmed.

Hudson Rock found infostealer-compromised Microsoft credentials associated with several affected organizations and believes stolen credentials may explain the campaign, rather than an Azure zero-day. Other possibilities haven't been ruled out.

Question for the community:

If an attacker gets authenticated access to Entra ID, how much directory visibility should an ordinary compromised employee account actually have?

And are organizations paying enough attention to directory reconnaissance and bulk enumeration as post-compromise activity?

Researchers broke into passkey logins using three separate attacks, targeting the login method Apple, Google, and Microsoft have pushed as phishing proof.

The attacks work on the browser and device layer rather than cracking the cryptography itself. Millions of people have already replaced passwords with passkeys on major sites.

What do you think? Are passkeys still the strongest option available, or does the phishing resistant label promise more than it delivers?

A new artificial intelligence service marketed for criminal activities has been advertised on the BreachForums hacking community.

Key Points:

• MessiahGPT is a criminal AI service currently being promoted on BreachForums.
• The service is advertised to individuals interested in illicit cyber activities.
• The listing indicates the emergence of new AI tools targeted at the underground market.

A service known as MessiahGPT has appeared on BreachForums, a well-known online forum for cybercriminals. The platform is being advertised as an artificial intelligence tool designed to facilitate criminal operations. This development highlights the growing intersection between advanced AI technology and underground hacking communities.

The presence of such a service on BreachForums suggests that threat actors are actively seeking to leverage AI for malicious purposes. While specific technical details of the service's capabilities are not provided in the initial advertisement, its existence signals a potential shift in how cybercriminals may conduct their activities. Security researchers and organizations should monitor this development for further details on the tool's functionality and potential impact.

How do you think the availability of criminal AI services like MessiahGPT will change the landscape of cyber threats in the coming year?

Learn More: Hack Read

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

A new website lets drivers check whether their license plate has been searched in Flock Safety's camera network.

Flock's automated readers are used by thousands of US police departments and log plates and locations as cars drive past. Supporters call the lookup tool basic transparency, while some law enforcement groups say it could tip off people under investigation.

What do you think? Should drivers see every search run on their plate, or should those records stay closed?