Tell HN: Namecheap gave my account to an unverified third party
345 points by Thrashed | 128 comments
A Tell HN post describing how Namecheap support handed over a user's account to an unverified third party who simply called and asked.
#social-engineering on Hacker News
19 stories tagged social-engineering, newest first.
A backdoor in a LinkedIn job offer(roman.pt)
1552 points by lwhsiao | 295 comments
Blog post by developer Roman Imankulov describing a backdoor hidden in code sent as part of a LinkedIn job offer, how it triggers, and the borrowed identities used.
The newest Instagram “exploit” is the goofiest I've seen(0xsid.com)
2099 points by ssiddharth | 466 comments
Blog post describing an Instagram account takeover wave, including the Obama White House account, reportedly done by abusing Meta's AI support bot.
Obsidian plugin was abused to deploy a remote access trojan(cyber.netsecops.io)
341 points by cmbailey | 202 comments
Threat analysis article on a social engineering campaign abusing an Obsidian plugin to deliver the PHANTOMPULSE RAT to finance and crypto professionals.
GoDaddy gave a domain to a stranger without any documentation(anchor.host)
533 points by jamesponddotco | 212 comments
Anchor Hosting blog post describing how GoDaddy transferred control of a client's domain to a stranger without requiring any documentation.
I have recordings proving Coinbase knew about breach months before disclosure(jonathanclark.com)
600 points by jclarkcom | 179 comments
A personal blog post arguing, with recordings and emails, that phishing attacks tied to the Coinbase data breach began in January 2025, months before Coinbase's disclosure.
I almost got hacked by a 'job interview'(blog.daviddodda.com)
829 points by DavidDodda | 427 comments
A blog post by David Dodda recounting how a fake job interview attempted to get him to run malicious code on his machine.
Scammed out of $130K via fake Google call, spoofed Google email and auth sync(bewildered.substack.com)
338 points by davidscoville | 536 comments
A Substack post by David Scoville recounting how he lost $130,000 to scammers using a fake Google call, spoofed Google email, and authenticator sync.
We identified a North Korean hacker who tried to get a job(blog.kraken.com)
348 points by 2bluesc | 253 comments
Kraken blog post describing how the crypto exchange identified a North Korean hacker who applied for a job at the company.
A phishing attack involving g.co, Google's URL shortener(gist.github.com)
345 points by zachlatta | 147 comments
A GitHub Gist by Zach Latta describing a sophisticated phone-based phishing attempt impersonating Google that abused the g.co domain to steal Google accounts.
How to lose a fortune with one bad click(krebsonsecurity.com)
322 points by todsacerdoti | 323 comments
KrebsOnSecurity article from December 2024 about how a single malicious click led a victim to lose a fortune, likely via phishing and account takeover.
Things the guys who stole my phone have texted me to try to get me to unlock it(gothamist.com)
369 points by neaden | 192 comments
Gothamist article in which a reporter recounts the scam texts phone thieves sent trying to trick them into unlocking a stolen phone.
Timeline of the xz open source attack(research.swtch.com)
967 points by todsacerdoti | 431 comments
Russ Cox's blog post giving a detailed timeline of the social engineering behind the xz/liblzma backdoor attack by "Jia Tan".
Recent 'MFA Bombing' Attacks Targeting Apple Users(krebsonsecurity.com)
379 points by vdddv | 212 comments
KrebsOnSecurity article on phishing attacks that abuse Apple's password reset feature to flood devices with prompts, followed by calls spoofing Apple support.
Finance worker pays out $25M after video call call with deepfake CFO(edition.cnn.com)
417 points by bsdz | 297 comments
CNN news article about a Hong Kong finance worker who paid out $25 million after a video call with scammers using a deepfake of the company's CFO.
Verizon fell for fake "search warrant," gave victim's phone data to stalker(arstechnica.com)
339 points by Shank | 132 comments
Ars Technica article reporting that Verizon handed a victim's phone data to a stalker posing as a police officer with a fake search warrant.
North Korean campaign targeting security researchers(blog.google)
544 points by todsacerdoti | 267 comments
Google Threat Analysis Group blog post from September 2023 describing an active North Korean campaign targeting security researchers.
Kevin Mitnick has died(dignitymemorial.com)
3604 points by thirtyseven | 589 comments
Dignity Memorial obituary page for Kevin David Mitnick, the famed hacker and security consultant, who lived from August 6, 1963 to July 16, 2023.
You can deactivate anyone's WhatsApp account by simply sending an email(twitter.com)
434 points by KomoD | 198 comments
Tweet by Jake Moore showing he deactivated a WhatsApp account on a test device by emailing WhatsApp support claiming the phone was lost or stolen.