He must have been really tired, he even stated all the warning signs he ignored.
If anything it should just be a warning that literally anyone can make a mistake due to stress/fatigue/whatever
this post was submitted on 27 Mar 2025
690 points (99.0% liked)
Technology
68244 readers
4047 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
I've clicked an obvious phishing link once in an isolated environment with a hardened browser on purpose. It had a tracking link and all and the URL was just ever so slightly off. Nothing happened on the target page though. No attempted script execution, no iframes, no cross site shenanigans, no weird popups or a fake login UI urging me to enter my credentials asap.
Someone from my company's security department called me shortly, telling me how I've failed the obvious phishing exercise and I had to undergo a half hour long mandatory awareness training. Wasn't getting out of that one.
If you look at the headers, you can tell which ones are fake phishing and real phishing.
Please explain
Most companies add an email header like "X-PHISHTEST" to the phishing tests (and a corresponding spam filter rule) to ensure they don't get caught by spam filters. If you look at the headers of a spam email, the company test emails will have that header.
Any company that does that needs to be sent on a mandatory awareness training for failing an obvious fake phishing exercise. It's far too easy to whitelist that and send it to an "ignore" folder.
Is there anything bad that can happen if you just click a link without logging in or anything? How is it different from opening up a random search result?
Not all phishing links are related to credential theft or trying to get you to download something malicious. Zero-day vulnerabilities in web browsers are revealed constantly. A malicious website (or malicious content embedded into an otherwise benign website) can leverage these or other unpatched vulnerabilities when visited.
You should never follow a known or suspected phishing link unless it's your job and you are using the appropriate tools and techniques. Just report it to the security department or delete it and move on with your day.
Does that also mean I should not browse any websites I don’t already know? That’s very limiting.
I never said that. I said do not follow known or suspected phishing links. It takes practice and skill, and it is not always simple. But if you know if it is a risk, you should consider avoiding the risk.
"This looks like it might be phishing. Let me check it out and see what's on the other side." <--- That's what I am suggesting to avoid.
Security is an onion: layered. Patched software. Good, unique passwords. MFA. Various security defense tools. But technology can have gaps, flaws, or be circumvented. It's important to keep in mind that us as individuals are also a security layer, and are often the first or last line of defense.
I’m no expert, but as I understand it, there are several things that can go wrong just by clicking. This depends somewhat on your browser settings and how you use it.
Visiting a compromised site may allow the attacker to access data from other tabs and windows in the same browser session. Some sites warn you to close the whole browser when logging out because of this.
Sometimes bugs in a browser can allow a site to run arbitrary code on your machine. These hopefully get patched quickly.
If the link was unique to the email, then it could be a signal to the phisher that is a valid address for further targeting.
Happens to the best.
I work for a managed service provider, and security for our clients is one of our most important goals.
Our CEO accidentally got phished then sent out emails to all our clients. We rolled with it by explaining kinda what you just said.
I’m not just the owner, I’m also a member!
Thats why we have RSS feeds. Thats how I follow Troy
TIL: Nobody is perfect
You live and you learn it
glares in the general direction of the White House
...did you think there were perfect people in the White House before this? Or at any point in your life? Haha
(Maybe as a child would that make sense...)
load more comments
(4 replies)
load more comments
(3 replies)
Solving the "being human" part of security will probably never happen, which is why you're encouraged to do stuff like use 2FA, different passwords, service isolation and stuff like that.
Anyone and everyone can be fooled at some point, best to try and limit the damage.
FIDO2 and security keys are the closest things we have to a solution. Unfortunately far too few companies support them. It would have saved him here because each credential only works with the proper URL for it.
I just never click links in email.
If you use a password manager it won't fill credentials because it will be the wrong domain
Unfortunately the article said he just put in his credentials anyway, even though his password manager wouldn’t autofill for him. Pretty stupid, but at least he acknowledges it
I clicked one once by accident when trying to select it. You can be as diligent as you want you still will slip up from time to time
Should have put the safety on. You need some trigger discipline.
Never point an email at something you're not willing to click.
load more comments
(1 replies)
AT this point it is safe to assume you will fall for scams like this in your life. They are too like the real thing. We need the laws and police to catch up to investigating this thus making crime not pay (most of this is from countries that don't work with police - so probably some major international efforts required as well).
I almost fell for a bank scam a couple years back. Basically, I had just gotten a new phone w/ GrapheneOS, which doesn't have Google's scam number protection (I was well aware, that's not the issue) and I hadn't yet transferred my contacts, and I received a call about a fraud alert on a card. This has happened a few times, and usually it's a pretty straightforward call where they verify my identity before asking me about certain transactions. As a bit of background, I was on vacation at the time and I got the call while waiting in the parking lot while my SO ordered something at a food truck.
Anyway, the call progressed like this:
- Mentioned , which I have
- Asked to verify my identity with a code to my phone - standard
- Went over a couple suspicious transactions, which I confirmed wasn't me
- Asked to verify my identity again, and that's where I got suspicious, so I didn't provide it
I immediately called my bank and sorted things out, and we figured out nothing was stolen because I didn't provide the second code (that was to link an external account to suck my money out). Because I was in an unfamiliar setting and honestly pretty tired (we drove all day the day before), I just skimmed the text in step 2 w/o reading that it was a user-initiated code (i.e. for a password reset) instead of a bank initiated code (i.e. verify identity).
I consider myself a pretty security-conscious person. I use a password manager, MFA everywhere I can (preferring TOTP), I'm a lead backend SW engineer who has caught multiple security issues, etc. However, I fell for the scam and missed the safeguard that should have protected me. Fortunately it all worked out, but I did have to change all of my account numbers and login, which wasn't particularly fun while on vacation. That bank is fortunately one of the few that supports TOTP in my country, though I had avoided setting it up because it required a special app (Symantec VIP) and calling in (no self-service). I now have it set up and feel much better about my account security.
I'm fairly certain I annoy the people at my bank because I always insist on calling them back at their official number if they ask for any personal information. I don't fuck around with my bank security. I did however get got a couple of more years ago back when the chrome browser window phishing attack first started and had my Steam account stolen for a solid minute.
That's the attack where they simulate a browser window so what you think is a oauth popup is actually just inpage javascript and CSS.
load more comments
(5 replies)
load more comments
(6 replies)
load more comments
(6 replies)
The original article: https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/
Don't password managers verify the domain name before offering credentials?
Does that mean he doesn't use a password manager?
Edit: RIP, now that's a proper phishing. I understand where he's coming from
He mentioned that he does and the password manager didn't prompt to autocomplete the password automatically, so he had to force it.
The thing that should have saved my bacon was the credentials not auto-filling from 1Password, so why didn't I stop there? Because that's not unusual. There are so many services where you've registered on one domain (and that address is stored in 1Password), then you legitimately log on to a different domain.
Then add multiple URLs for that entry. You can even have it match on the base domain, so it works on any subdomain, or restrict it to a subdomain.
I assume that works on 1Password, it works on Bitwarden at least.
That said, I could see myself making this mistake. I've had to manually find entries before for one reason or another (e.g. usually use the app, but access the website this one time).
It does work there. The unfortunate thing is that so many sites change their login structure often enough that it no unusual to discover that a site just changed again and you need to update the list.
load more comments
(1 replies)
load more comments
(3 replies)
view more: next ›