Hackers influence ChatGPT and Gemini to direct users to scam centers(medium.com)
122 points by ArielSimon | 40 comments
Medium article describing how hackers manipulate AI assistants like ChatGPT and Gemini into directing users to scam sites.
#phishing on Hacker News
19 stories tagged phishing, newest first.
The URL shortener that makes your links look as suspicious as possible(creepylink.com)
743 points by dreadsword | 140 comments
CreepyLink is a joke URL shortener web tool that turns links into suspicious, sketchy-looking URLs.
I have recordings proving Coinbase knew about breach months before disclosure(jonathanclark.com)
600 points by jclarkcom | 179 comments
A personal blog post arguing, with recordings and emails, that phishing attacks tied to the Coinbase data breach began in January 2025, months before Coinbase's disclosure.
Want to piss off your IT department? Are the links not malicious looking enough?(phishyurl.com)
1024 points by jordigh | 296 comments
A joke web tool that turns any URL into a suspicious, phishing-looking redirect link that simply forwards to the original address.
Scammed out of $130K via fake Google call, spoofed Google email and auth sync(bewildered.substack.com)
338 points by davidscoville | 536 comments
A Substack post by David Scoville recounting how he lost $130,000 to scammers using a fake Google call, spoofed Google email, and authenticator sync.
We all dodged a bullet(xeiaso.net)
790 points by WhyNotHugo | 450 comments
Xe Iaso blog post reflecting on the NPM supply-chain compromise of popular packages like chalk and debug, arguing it could have been much worse.
Emailing a one-time code is worse than passwords(blog.danielh.cc)
806 points by max__dev | 637 comments
Blog post by Daniel Huang arguing that emailed six-digit login codes are worse than passwords because they enable easy phishing attacks, citing Minecraft account thefts.
Multiple Russia-aligned threat actors actively targeting Signal Messenger(cloud.google.com)
773 points by karel-3d | 271 comments
Google Threat Intelligence Group blog post describing Russia-aligned threat actors targeting Signal Messenger accounts.
Ask HN: Why buy domains and 301 redirect them to me?
345 points by HughParry | 114 comments
Ask HN thread where a SaaS owner asks why someone bought lookalike domains and 301-redirected them to his site, wondering if it's phishing or a resale scheme.
A phishing attack involving g.co, Google's URL shortener(gist.github.com)
345 points by zachlatta | 147 comments
A GitHub Gist by Zach Latta describing a sophisticated phone-based phishing attempt impersonating Google that abused the g.co domain to steal Google accounts.
How to lose a fortune with one bad click(krebsonsecurity.com)
322 points by todsacerdoti | 323 comments
KrebsOnSecurity article from December 2024 about how a single malicious click led a victim to lose a fortune, likely via phishing and account takeover.
GitHub notification emails used to send malware(ianspence.com)
423 points by crtasm | 168 comments
Blog post describing how GitHub notification emails were abused to deliver malware to developers.
USPS text scammers duped his wife, so he hacked their operation(blog.smithsecurity.biz)
372 points by wglb | 257 comments
Wired article about Grant Smith, who infiltrated the Smishing Triad USPS text scam operation after his wife was duped, and exposed it to US authorities.
Things the guys who stole my phone have texted me to try to get me to unlock it(gothamist.com)
369 points by neaden | 192 comments
Gothamist article in which a reporter recounts the scam texts phone thieves sent trying to trick them into unlocking a stolen phone.
Recent 'MFA Bombing' Attacks Targeting Apple Users(krebsonsecurity.com)
379 points by vdddv | 212 comments
KrebsOnSecurity article on phishing attacks that abuse Apple's password reset feature to flood devices with prompts, followed by calls spoofing Apple support.
Thanks FedEx, this is why we keep getting phished(troyhunt.com)
1506 points by ahonhn | 493 comments
Troy Hunt blog post criticizing FedEx for sending a legitimate duty-payment SMS with a third-party link that looks indistinguishable from phishing.
Google-hosted malvertising leads to fake Keepass site that looks genuine(arstechnica.com)
334 points by bovem | 173 comments
Ars Technica article on a Google-hosted malicious ad leading to a convincing fake KeePass download site with a look-alike URL and valid TLS certificate.
When MFA isn't MFA, or how we got phished(retool.com)
333 points by dvdhsu | 240 comments
Retool blog post describing a phishing attack on its employees and how Google Authenticator cloud sync undermined multi-factor authentication.
The .zip TLD sucks and it needs to be immediately revoked(financialstatement.zip)
469 points by me_again | 244 comments
A protest page hosted on a .zip domain arguing that Google's .zip top-level domain enables phishing by confusing URLs with filenames and should be revoked.