Troy Hunt Gets Phished
April 4 2025In case you need proof that anyone, even someone who does cybersecurity for a living, can fall for a phishing attack, Troy Hunt has a long, iterative story on...
Read moreSocial Engineering to Disable iMessage Protections
January 17 2025I am always interested in new phishing tricks, and watching them spread across the ecosystem.
A few days ago I started getting phishing SMS messages with a new twist. They...
Read moreJailbreaking LLM-Controlled Robots
December 11 2024Surprising no one, it’s easy to trick an LLM-controlled robot into ignoring its safety instructions.
Read moreClever Social Engineering Attack Using Captchas
September 20 2024This is really interesting. It’s a phishing attack targeting GitHub users, tricking them to solve a fake Captcha that actually runs a script that is copied to the command line. Clever.
Read morePython Developers Targeted with Malware During Fake Job Interviews
September 17 2024Interesting social engineering attack: luring potential job applicants with fake recruiting pitches, trying to convince them to download malware. From a news article
These particular attacks from North...
Read more
AI Voice Scam
May 1 2024Scammers tricked a company into believing they were dealing with a BBC presenter. They faked her voice, and accepted money intended for her.
Read moreUsing Legitimate GitHub URLs for Malware
April 22 2024Interesting social-engineering attack vector:
McAfee released a report on a new LUA malware loader distributed through what appeared to be a legitimate Microsoft GitHub repository for the “C++...
Read more
Other Attempts to Take Over Open Source Projects
April 18 2024After the XZ Utils discovery, people have been examining other open-source projects. Surprising no one, the incident is not unique:
The OpenJS Foundation Cross Project Council received a suspicious...
Read more
Backdoor in XZ Utils That Almost Happened
April 11 2024Last week, the Internet dodged a major nation-state attack that would have had catastrophic cybersecurity repercussions worldwide. It’s a catastrophe that didn’t happen, so it won’t get much attention—but...
Read moreXZ Utils Backdoor
April 3 2024The cybersecurity world got really lucky last week. An intentionally placed backdoor in XZ Utils, an open-source compression utility, was pretty much accidentally discovered by a Microsoft engineer—weeks...
Read more
Recent Comments