---
id: 6583
title: "How I stole the identity of every Yahoo user"
source_domain: samcurry.net
source_url: "https://samcurry.net/how-i-stole-the-identity-of-every-yahoo-user"
published_at: "2017-05-09T00:00:00Z"
tags: ["ai-security", "bug-bounty", "email-security", "spoofing", "yahoo", "header-injection", "crlf-injection", "samcurry-net"]
phying_url: "https://phying.com/item/6583"
lang: en
---

# How I stole the identity of every Yahoo user

## Summary

How CRLF injection in Yahoo's fantasy-sports invite emails let attackers spoof and hijack messages: user-supplied names flowed into mail headers, opening identity spoofing across the platform.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2017-05-09T00:00:00Z
- **Original:** https://samcurry.net/how-i-stole-the-identity-of-every-yahoo-user
- **Phying News:** https://phying.com/item/6583