Hacker News

points by sva_ 4 days ago | 0 comments

It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):

https://isc.sans.edu/diary/32942

It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?

And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.

[–] mapmeld 3 days ago

For people who were newly nervous about clicking an unfamiliar link, this is a blog post describing the initial intrusion - the attackers paid for an ad on Google Search mimicking the homebrew website, which tells you to install it through a script. It's something you might have copied directly into the terminal before.

[–] rddbs 3 days ago

No, what would be crazy is to think that zero engineers would fall for this.

[–] mrheosuper 3 days ago

NGL i can see 2 AM, caffeine-fueled version of me fails for this

[–] arm32 4 days ago

Let's not victim blame plz