Mastodawn

ṫẎℭỚ◎ᾔ ṫ◎ℳ 1d ago

IDK who Deb Eskew is, but I certainly glanced askew when reading this. See how many red flags you can spot. This one seems to have them all:

-unbidden attachment (which couldn't be auto-scanned for malware btw)
-no actual greeting or salutation
-a password needed to unlock the attachment
-relevant (if a bit on-the-nose) social engineering involving a podcast ostensibly focused on fraud;
-Google is clearly glancing askew here, too, but kind of tapping out on a verdict because it ultimately made it through.

Allan Chow 1d ago

@briankrebs my first thought was the production company view askew

Third spruce tree on the left 1d ago

@grumpasaurus @briankrebs hey listen if "Kevin Smith" sent me an unbidden attachment and said it was the screenplay of his next movie that he's Kickstarting and its a sequel to Dogma he's aleady got Chris Rock, Charlize Theron, Keanu Reeves and Ian McKelleren onboard and would I want to become an investor I'd be thinkin hard as I hover over that attachment.

Allan Chow 1d ago

@tezoatlipoca @briankrebs time to bring up this gem of a scene

https://youtu.be/lmxAhXYQdmY?si=rVSzYu28npVq5kRF

Matt Damon cameo Jay and silent Bob reboot

YouTube

Third spruce tree on the left 1d ago

@grumpasaurus @briankrebs lol that's quite good.

Ariadne Conill 🐰

@briankrebs idk but i would not go on anything titled the 'easy prey podcast'

@ariadne @briankrebs Right? With your host, Nota Badguy

ṫẎℭỚ◎ᾔ ṫ◎ℳ 1d ago

@briankrebs she’s clicking looks safe 🤷‍♀️😩

Nate Bartram 1d ago

@briankrebs Also used BCC to email you.

"Easy Prey" lmao. Pretty on the nose.

At least all the names and emails match up. I get so much spam from Name A @ email, the actual display name is Name B, then it's signed by Name C @ email2, none of which are even close to each other. 🤷

Cat 🐈🥗 (D.Burch)

@briankrebs Their next malware campaign is titled "Low Hanging Fruit"

cR0w 🏴‍☠️🫈🫍1d ago

@catsalad @briankrebs Low Hanging Plums is an excellent op name.

Cat 🐈🥗 (D.Burch)

@cR0w @briankrebs

⁠

cR0w 🏴‍☠️🫈🫍1d ago

@catsalad @briankrebs How is there no plum emoji? This is outrageous!

@cR0w @catsalad @briankrebs 🍇 ?

Sterling 1d ago

@briankrebs
I am reminded of this old skit:
https://youtu.be/eY7ZX6ngOSs?t=12

Usually *plenty* of queues before you step in it.

Cheech and Chong- Dog Shit

YouTube

katzenberger 1d ago

Quite interesting, since by name, there is an established LinkedIn account for Deb Eskew, the podcast website exists, and they had people like @hacks4pancakes , @pluralistic , @FirewallDragons , Esther Dyson and several others on the show.

I'm not using GMail so I can't tell whether you'd get alerted about DKIM verification failure; and the sending account per se might also have been compromised, anyway.

But if that mail is genuine, it's a sad self-own. What would even be the point of password-protecting an attachment, and then pasting that password into the very same email.

@briankrebs "Easy Prey" as a name for a podcast anything is a big red flag

@briankrebs Deb Askew is an anagram of Asked Web. Not helpful but mildly apropos.

@briankrebs I'd love to just block password-protected attachments, but Japanese vendors insist on using them for quotations.

Jack the Waterlogged Count 1d ago

@briankrebs Someone had a bit of fun coming up with the "podcast" name, and I don't blame them one bit, for that particular element of the criminal enterprise.

@briankrebs

before opening that attachment, time to easy pray...