HN user
Companies make this hard, a bit like various email scams where legit company communication comes from seemingly random domains (hello paypal). Often the company is legit, but theres no public contact that knows anything about the recruiter thats working for them.
Compromising a crappy wordpress site means compromising mailbox credentials.
This isn't LinkedIn specific - the easily misclickable "one click to logon with Google" button showing up in browsers was a huge mistake and should never have existed. Reddit has started prompting too if you're not currently logged in, to just suddenly be logged in with Google.
Making them "fashionable" seems to be a selling point, as seen woth the last advertising positioning largely to the woman's fashion industry. They are definitely aiming to not look like nerdy tech.
There's an astounding amount of .DS_Store showing up - I hadn't realised how common it apparently is for people to accidentally upload this.
Our helpdesk deals with 2-300 users per day that logon every single day yet forgot their password.
This type of thinking doesn't work in large enough orgs dealing with end users.
Vulnerable dependencies are very different to compromised or backdoored dependencies though. Noone's taking over Solarwinds because their build tools had a ReDOS involving input from their own config files.
I'm reading the ZeroBounce docs and it seems very relevant. Look at this step:
"We recheck all unknown emails using IPs from different geographical locations". This matches exactly what this article describes as getting these emails from a range of locations.
The step before that is just "Proprietary Technology", which sounds like a good cover for what's going on here. How else are you testing an email address after between "real time SMTP server check"?
All of them.
My personal tax agent only accepts forms and sends them back via email. I had a conversation with him about using password protected zips and he just told me he won't accept them.
My hospital sent me a PDF that I was to fill in and email back with cleartext credit card information filled in to pay bills. Screenshot:
https://infosec.exchange/@jsmall/116745959468132388
I recently deal with an inheritance and the Super Fund would only accept legal documents by email. I could go on, this is normal.
Yeah, it did always get me as a design issue. I get that "there's more to ask them" is valid. But there's never an indication of "OK I've said everything now". You only find out when they start repeating themselves.
"Make the person repeat what they just told you" as a process is very immersion breaking.
If they run a mortgage broking business, they should have a very different experience to what's described in this post about setting up like a personal machine. They presumably have business managed Microsoft accounts, none of that setup happens, and most of setup prompts are totally automated away from you after logging into such an account.
As an Australian.. politically I need to worry about business data touching China. It will come up at a Risk Advisory Committee meeting as a serious issue.
In actual personal practice, no. China having my data presents no actual impact to me, America will do things that impact me.
You can find the link to the victims leaks page and screenshots of it working right here:
https://www.ransomlook.io/group/the%20gentlemen
They appear genuinely prolific.
A lot of those same people seemed perfectly capable of insisting on 60 day password rotation back when they could use nist guidance as an authority to appeal to (for about five years after the recommendation changed too).
Claude, for my non Gmail domain, expects me to click a magic link on every device I wish to use it. Its wild that a product like that cannot take a password, or a passkey.
Ten times shorter just means "readable without losing an excess of time on ramble" and I feel like someone's comeback to this will be "you should ask an AI to summarise".
The researcher's own statements note that the zero days were not found with AI.
And honestly I think that's the part that Microsoft is most upset about, because every internal partner conversation I've had has been about needing to buy Security Copilot because all the advanced attacks are coming from AI, and just suggesting vulnerabilities existed before AI seems to make salespeople uncomfortable continuing the conversation.
The problem with all these permissions ideas: VSCode in most cases is expected to be able to push to a git repo. Many developers these days use it over the CLI for pushes and pulls.
So if it has a "minimal" set of access, it has access to a Github key. That's enough.. to do this sort of damage.
Note that despite being named here as "Azure Linux" and being described as a "General purpose Linux OS for Azure", once you go to the product documentation it's referred to as "Microsoft Azure Linux Container Host for AKS", and the Quickstart guide is about how to deploy a Kubernetes cluster. It doesn't seem very capable of general use.
A hospital could not learn a bigger lesson from this person than their existing big players.
(Screams in "deployed in 2026 a new product that only works in internet explorer" in healthcare).
Yeah, all my friends watched it when it was new. After an episode played we would talk about it the next day.
Im pretty sure none of us saw the final few seasons, with it moving to a late night time slot and noone caring.
I guess I woukd say youre fortunate to have not worked in a "we cannot use github.com because we take security very seriously" environment. Because always tells me you'll be running a on prem product that might get updated once a year.
I think it says something about what tech is delivering: The article claims the main reason for closing was competition from online stores like Temu.
Yes this is what im confused about. They described it as a parking domain, but the old strategy of "buy a popular domain and put ads on a one pager" hasn't been something that pays substantively for a long time. Ads sales have plummeted in general but not being able to use adsense would make it worse.
The first example I looked at was haute-sorne.ch, which is reported by this tool as "Self hosted/other". Whilst it's true that they appear to self host, https://mails.haute-sorne.ch will land you on a Microsoft Exchange server, patch level 15.2.1748.39.
This is better than typical, being an October 2025 patch. But that leaves open CVE-2025-64667, CVE-2025-64666 and CVE-2026-21527. Which are vulnerabilities with patches out going back months.
Now are these RCEs? No, but this was also the first example I looked at.
Surely there is a cost to sterilising too.
Seriously this is my bugbear with code for windows: how did you figure that invocation out?
Anything for Linux you just type "make". If the author skipped a makefile, theres rarely much to it.
But when someone has a cpp file for Windows it looks like this.
Im running APL only stickers on my keyboard because it seemed more entertaining than blank caps for touch typing. Freaks people out, but really enjoy it.
Outside of these unfortunuate situations, a lot of people are quite happy for developers of eg kernel anti cheat to have a difficult time.
We do need to recognise, a long history of "windows always bluescreens" was somewhat reigned in by this policy with a lot of crashes coming down to third party drivers.
There's more to it. Signed desktop software can be signed by any CA.
Veracrypt has kernel drivers. Microsoft's ability to control what you can sign is specific to kernel drivers, and Microsoft's trigger finger around bans exists in the world where bad drivers BSOD machines.
In general this isn't your problem.