Comment on GDID Windows – Cut the tracker that follows you even under VPNparentComments−nickphx1moThey claim it was an ngrok account that was used to host an endpoint used in the compromise, tied to a microsoft account / gdid that was passed when ngrok software was downloaded from the "microsoft store".−sorenjan1moThat wouldn't explain how they connected the GDID to the visit to the retailers websiteThree hours later, the same GDID visited the retailer’s own website, through the same Tzulo proxy address used to set up the ngrok account.
Comments
They claim it was an ngrok account that was used to host an endpoint used in the compromise, tied to a microsoft account / gdid that was passed when ngrok software was downloaded from the "microsoft store".
That wouldn't explain how they connected the GDID to the visit to the retailers website