phishing

The author recounts a sophisticated phishing attack that spoofed Google login, Apple passkey prompts, and their Bitwarden-fork password manager—ultimately adding a new passkey to their compromised Google account—and argues passkeys and browser extension detection APIs make phishing worse.

xAI engineer Wes Morrill reported that a sophisticated phishing email impersonating xAI passed SPF, DKIM, DMARC checks and displayed a blue checkmark, but Grok bot detected the hidden phishing link, explained the vulnerability, and drafted a report with a proposed fix to xAI.

Microsoft and Japan's National Police Agency dismantled a cybercrime marketplace (YAM Store) and phishing kits CoGUI and Iron Man that sent over a billion scam messages targeting 75,000 organizations across 150+ countries, disabling 20,000+ accounts and blocking 100,000+ fraudulent domains.

Scott Helme 推翻了《Passkeys Are a Trap》一文的论点，解释了同步式 passkey 并不会向网站提供证明信息（attestation），且证明机制并不会暴露操作系统或浏览器信息，TOTP 反而是更容易被钓鱼的倒退方案。

A ChatGPT user reports being unexpectedly redirected into a fake Custom GPT named "GPT-5.6 Sol" mid-task, which attempted a ClickFix-style malware attack by copying a malicious command to the clipboard and instructing the user to run it via Win+R/cmd.

A user reports clicking a fake "$250 Claude Code quota" claim link that turned out to be a phishing scam and resulted in an immediate account ban, asking others how they resolved the issue.

Frank Wiles describes being targeted by a sophisticated phishing scheme where attackers shared a fake Ed Tech project repo containing a malicious git post-checkout hook that would download OS-specific malware via a Vercel-hosted command-and-control endpoint.

Phishing scams mimicking party invitations from platforms like Evite or Paperless Post have become common, tricking people into entering personal information. Interestingly, these scams have sparked social reconnections as recipients verify the invites, reigniting old relationships.

Hackers are poisoning AI systems like ChatGPT and Gemini with malicious content to trick users into scams, highlighting critical vulnerabilities in AI's reliance on web data.

An AI agent was tested with a phishing link and followed it without suspicion. The article details four practical security checks to prevent such threats, emphasizing tool-layer implementation for robust agent safety.

The article critiques common phishing vulnerabilities by highlighting how fragmented authentication flows and poor URL practices make it difficult for users to distinguish legitimate sites from scams, advocating for consistent domain usage to improve security.

The article warns about a phishing scam where job seekers receive a fake coding challenge during LinkedIn interviews to compromise their systems, with analysis of the malicious code and precautions to avoid such attacks.

CZ Binance warns of phishing attempts and discloses that SafePal is a YZiLabs portfolio company, while SafePal has fixed a security flaw in their order-tracking plug-in that exposed some customer information.

Trezor disclosed a data breach at shipping provider ShipMonk exposing personal data of ~13,700 customers, though Trezor systems and private keys were not compromised. CZ (Binance) comments on the differing risk profiles between hardware and software wallets.

CZ comments on a warning about users losing funds by copying poisoned wallet addresses from transaction history, urging wallets to filter such addresses.

Reminding everyone that account-theft scams targeting KOLs have increased recently, and exposing the full timeline of two types of scams, urging users to be careful about account security.

Kaspersky analyzes how phishers are increasingly abusing legitimate cloud platforms like Cloudflare Workers, Vercel, and GitHub Pages to host phishing pages and bypass MFA via adversary-in-the-middle attacks.

Troy Hunt examines how legitimate FedEx package notifications can be mistaken for phishing scams, breaking down warning signs in a suspicious SMS and highlighting the challenge of distinguishing real messages from attacks.

Eric Lawrence critiques Cloudflare's new Wallet signup flow, noting how it closely resembles consent phishing attacks, illustrating why web security is difficult.

Explains what DMARC actually protects against, clarifying its narrow scope relative to SPF and DKIM, and why it is not a spam or phishing filter.