Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Turning Cluely Into Malware

hacktron.ai | blog | #data-exfiltration | #electron | #desktop-app | #cluely | #will-navigate | #screenshot-capture

Summary

How we found a vulnerability in Cluely's Electron app that let any website silently capture screenshots, record audio, and exfiltrate everything - all because of a missing will-navigate handler.
Published
Collected

original ↗

Related coverage

vulnerability · hacktron.ai
Remote code execution on Discord Desktop
A detailed walkthrough of chaining XSS with CSP bypasses and Electron misconfigurations to achieve full remote code execution on the Discord Desktop client, with lessons for Electron app hardening.
blog · bughunters.google.com
Mitigating URL-based Exfiltration in Gemini
This post takes a look at how Gemini and other agents created by Google mitigate URL-based data exfiltration attacks.
blog · portswigger.net
Using recursive grep for harvesting data
Burp Intruder's 'recursive grep' builds each payload from the previous response, ideal for error-based SQL injection that returns one value at a time — harvesting a whole table without a script.
blog · blog.trailofbits.com
Lack of isolation in agentic browsers resurfaces old vulnerabilities
Trail of Bits exploited missing isolation in agentic browsers to enable XSS/CSRF-like attacks, from false information to cross-site data leaks, resurfacing decades-old web vulnerability patterns.
blog · blog.trailofbits.com
Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more
Trail of Bits details Electron CVE-2025-55305: overwriting V8 heap snapshot files bypasses code integrity checks, enabling local backdoors in Signal, 1Password, Slack, and other Chromium-based apps.
blog · blog.trailofbits.com
Weaponizing image scaling against production AI systems
Trail of Bits shows how image-scaling attacks hide prompt injections visible only after downscaling, enabling data exfiltration on Gemini CLI, and releases the open-source Anamorpher tool.
back