Story time!

PSA THIS WAS ORIGINALLY POSTED ON INSTAGRAM. If you want to see videos earlier, follow me there. Same account name.

aww man. I was hoping for a big hacker story!

I’m not even asking why you have bdsm stuff 😂😇

1) it’s a horse crop. For horse back riding. 2) I bought it for the video.

@ClownYouAllDay For horse what... 👀

@endingwithali What did I start? 😭 I was just joking around. Not all jokes are winners. I’m sorry Ali. 💙 please don’t hurt me.

Okay but why your pronouns in your bio? You’re clearly a girl?

Delete ur account

That’s not very nice. Why would you say that? Are you clearly not a girl?

I took a class with Hak 5. Before your time though darling.

Uhhh why do you own that whip.

.

I'm having difficulty following a card that was used that doesn't exist. It sounds like a phishing scam from the get-go in which someone spoofed you having a card you don't have attached to your bank account.

Couldn’t have been phished because I didn’t click any links to give access to the card or account

@AFK7Music Are you aware about the whole Cyrillic alphabet URL thing?

@AFK7Music Are you aware that I said I only used my card once, checking into my flight?

@AFK7Music Yes and what I'm is that it is 6ï but possible that you clicked on a link from inside your email or whatever that directed you to a page that your browser said looked good but was really a malicious URL with one letter encoded in Cyrillic that you did not notice.

@AFK7Music I went to (flight carrier) dot com. Typed it manually in on my own

Great video Ali

👏🏻

I wasn't going to watch your vid because I thought it would be silly. Glad I sat through it...It was cute and funny. Also glad you made it clear that "the hack" wasn't really tied to DEF CON. You should post a follow up and let us know the trials and tribulations of getting the charges cancelled.

They would have to do MUCH more than break the TLS if capturing cellular frames.

OMG, I was wondering if anyone was still trying to persuade the world to use the word ‘cracker’ instead of ‘hacker’ and I see that even in 2026 plenty of people are still arguing over it. 😂

Isn't guessing card info hard enough to not try. Bank I use still don't have virtual cards.

....they dont have to hack your cell phone. just the server you were submitting payment information to...ie: web skimmer that captures payment info as it is entered. non-invasive, silent. looks like normal cookie/ad traffic. .js supply chain inject. no billion dollar hacks req'd

We're in daylight time here, so PDT. :)

I love the lighting in the video ! Awesome work!

Perhaps it was a challenge to enter a gang of super cool hackers?

I thought the dorks with the wifi pineapple on the plane got you

I got hit by a cab with a skimmer. Fortunately I only use a limited account while there. Card would not tap or chip. tried a few times and then swiped. within an hour they were getting groceries in LV. lovely bank alerted me for one charge but let two other go through.

They likely used an IMSI-catcher since you said you used cellular and not Wi-Fi.

Or just have the failsafe of using a bank that you can lock your card. This feels unnecessary. If you don't think a 0 click 0 day was used at DC34 you are wrong. You would need to RE it to solve it so it's no big deal to hit apple watches to get card info off iphones. :) Why waste your time on triage or ZDI when you can skim to crypto 😆 🤣 😂

Most likeley got skimmed just before going always takes a bit for it to happen

Wrong! Card has never existed in any form besides numbers on my bank account. No physical form.

Soo then how did they get you then ……

Watch the video?

I did

Watched it again … you think it’s random … maybe …. Still not sold on that though … good luck either way hopefully nothing lost in the end

your delivery is hilarious and awesome