We almost got "phished" this week. Not by some sloppy "Nigerian prince" email but by a fake client. Here's what happened... Someone filled out the contact form on our website. They said they needed… | Iztok Smolic 🩸 | 13 comments

We almost got "phished" this week. Not by some sloppy "Nigerian prince" email but by a fake client. Here's what happened... Someone filled out the contact form on our website. They said they needed help with a software project. The email looked normal. The spec looked normal (a bit AI-generated, but who isn't using AI these days?). They sent a Dropbox link with a TAR file. Inside was a git repo and a note: "please check out the NDA branch first". During a weekly sales sync meeting, Ales noticed something was off. The sender's domain was off by one letter from a real website. We looked closer at the repo. There was a hidden "post-checkout" hook in the codebase. A binary file. If any developer had run "git checkout NDA" on their machine, that binary would have executed with their full user permissions. We pulled it apart in a container with Claude's help. It had scripts for Linux, macOS, and Windows. It was built to grab system data and ship it off to an API hosted on Vercel. We work with clients like Deutsche Telekom and University of Ljubljana. One "git checkout" away from a very bad day. Phishing isn't just bad emails anymore. It's full fake projects, with specs and repos and personas. People are reporting the same trick disguised as job offers. A "recruiter" reaches out, sends a coding test or a take-home repo, and asks the candidate to run it locally. Same playbook, different wrapper. If your developers run that on a work machine, you have the same problem we almost had. If you lead a dev team, talk to your people this week. Show them this story. The next attack won't look like an attack. It will look like a client or a job opportunity. Has anyone else had these experiences? | 13 comments on LinkedIn

18 Popular Code Packages Hacked, Rigged to Steal Crypto – Krebs on Security

Phishers Target Aviation Execs to Scam Customers – Krebs on Security

You’ve been phished. What to do next... - CyberTalk

You've been phished! Once you've fallen victim to phishing, take these 5 steps to avoid identity theft and computer damage. See article.

10 Common Indicators of a Phishing Attempt: Protect Your Data Now - Redbeard Security

Introduction Phishing Phishing is a type of cyber attack that is used to steal confidential information from individuals or organizations. It is a growing....