MexicanMafia CORS withCredentials Admin Session Hijack via cors_exploit_poc.html

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects HTTP requests that reference or serve the 'cors_exploit_poc.html' file, which is associated with the MexicanMafia (Operation Escaneo) actor's method of exploiting Cross-Origin Resource Sharing (CORS) misconfigurations. This exploit attempts to hijack active administrative sessions by leveraging CORS with 'withCredentials=true'.