A proof of concept demonstrates using the Hinge dating app as a command and control server by encoding binary payloads into images uploaded to profiles. The technique exploits publicly accessible Hinge profile photos and an undocumented API, requiring Android app patching to bypass certificate pinning via network security config modification. The implementation uses visual encoding to embed executables in images, retrieves them via API calls with specific headers, and decodes them back to working binaries.
Sort: