Top all-time · #3977
CloudSEK
Company blog · cloudsek.com/blogsecurity
CloudSEK is the company blog at cloudsek.com, writing about security. Since 2020, 18 different Hacker News readers have linked it 23 times, most often “Exploiting Undocumented API to Regenerate Google Service Cookies”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link CloudSEK's blog as a primary source for threat research on malware that keeps Google accounts logged in after password resets, and on a reported Oracle Cloud data breach.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
CloudSEK helps security teams predict and disrupt attack paths across digital risk, threat intelligence, external attack surface, AI systems, and third-party ecosystems.
Most-linked posts?
- Exploiting Undocumented API to Regenerate Google Service Cookies5 people · 5 mentions · first linked 2023-12-31
- No Honour Among Thieves: Uncovering a Trojanized XWorm Rat Builder Propagated By2 people · 2 mentions · first linked 2025-01-25
- GoodWill ransomware forces victims to donate to the poor2 people · 2 mentions · first linked 2022-05-25
- Part 2: Validating the Breach Oracle Cloud Denied2 people · 2 mentions · first linked 2025-03-24
What Hacker News says?
CloudSEK | REMOTE | https://cloudsek.com CloudSEK's XVigil is an AI-driven Digital Risk Management platform. XVigil monitors millions of internet sources across the Surface Web, Deep Web and Dark Web to detect cyber threats, data leaks, brand infringements, and identity thefts. CloudSEK XVigil has been helping organizations by providing timely, specific and actionable intelligence, thereby providing and attackers pe…
Comment linking /jobs
on “Ask HN: Who is hiring? (May 2020)”Submitted GoodWill ransomware forces victims to donate to the poor as a story · 503 points
HN discussionThis would be a better link; the blog post on which the Bleeping Computer article is primarily based. They refer to it but never link to it: https://www.cloudsek.com/blog/compromising-google-accounts-m...
Comment linking /blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking
on “Malware abuses Google OAuth endpoint to 'revive' cookies, hijack accounts”Submitted Exploiting Undocumented API to Regenerate Google Service Cookies as a story · 47 points
HN discussionNo wonder that explains the amount of ransomware garbage on Android devices out there: [0] and it is more prevalent on Android than iOS. [1] [0] https://www.cloudsek.com/threatintelligence/copy-of-malware-... [1] https://www.helpnetsecurity.com/2023/09/22/apps-attack-risk
Comment linking /threatintelligence/copy-of-malware-intelligence-analysis-of-daam-android-malware
on “BrowserEngineKit – Apple Developer Documentation”Submitted Hack: 6M Records for Sale Exfiltrated from Oracle Cloud Affecting 140k+ Tenants as a story · 39 points
HN discussionThe original reporter (CloudSek) is doubling down in his claims and now they put some evidence that contradicts Oracle https://www.cloudsek.com/blog/part-2-validating-the-breach-o...
Comment linking /blog/part-2-validating-the-breach-oracle-cloud-denied-cloudseks-follow-up-analysis
on “Hack: 6M Records for Sale Exfiltrated from Oracle Cloud Affecting 140k+ Tenants”Submitted Compromising Google Accounts: Exploiting Undocumented OAuth2 Functionality as a story · 5 points
HN discussionHere's a real-world example: https://cloudsek.com/security-flaw-in-atlassian-products-jir... "... cookie validity is 30 days. They only expire when the user logs out, or after 30 days."
Comment linking /security-flaw-in-atlassian-products-jira-confluencetrello-bitbucket-affecting-multiple-companies/
on “Ceremonial security and cargo cults”Submitted 2,500 Companies and 434,000 Pipelines Exposed – Largest AI Supply Chain Breach as a story · 2 points
HN discussion> Last October 2023, a user known by the pseudonym PRISMA revealed on his Telegram channel that he had managed to restore expired Google authentication cookies. This allowed him to access Gmail accounts, even if the user had changed the password, and generate new session cookies with which to continue entering them in an unauthorized manner. > Specifically, what they do is take advantage of an endpoint called MultiL…
Comment linking /blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking
on “New Malware Stays Logged into Stolen Google Accounts After Password Reset”Submitted Part 2: Validating the Breach Oracle Cloud Denied as a story · 2 points
HN discussionSubmitted No Honour Among Thieves: Uncovering a Trojanized XWorm Rat Builder Propagated By as a story · 2 points
HN discussionSubmitted OAuth2 Exploitation: Compromising Google Account Sessions as a story · 2 points
HN discussionSubmitted GoodWill ransomware forces victims to donate to the poor and those in need as a story · 2 points
HN discussionSubmitted PrintSteal: Exposing Unauthorized Websites Engaging in KYC Document Fraud as a story · 1 points
HN discussionSubmitted A Trojanized XWorm Rat Builder Propagated by Threat Actors as a story · 1 points
HN discussionSubmitted Threat Actors Abuse AI-Generated YouTube Videos to Spread Stealer Malware as a story · 1 points
HN discussion
