Open post gh0sti @gh0sti@mastodon.social · 4mo ago Replying to @matt@oslo.town @virtulis@loud.computer @matt@oslo.town @virtulis@loud.computer such cringe
Open post gh0sti @gh0sti@mastodon.social · 11mo ago Replying to @briankrebs@infosec.exchange <p>Meta, Meta, Meta. So Meta. This Reuters report is 🔥 </p><p>"Meta is earning a fortune on a deluge of fraudulent ads, documents show"</p><p>"Meta projected 10% of its 2024 revenue would come from ads for scams and banned goods, documents seen by Reuters show. And the social media giant internally estimates that its platforms show users 15 billion scam ads a day. Among its responses to suspected rogue marketers: charging them a premium for ads – and issuing reports on ’Scammiest Scammers.’</p><p><a href="https://www.reuters.com/investigations/meta-is-earning-fortune-deluge-fraudulent-ads-documents-show-2025-11-06/?utm_source=substack&utm_medium=email" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://www.</span><span class="ellipsis">reuters.com/investigations/met</span><span class="invisible">a-is-earning-fortune-deluge-fraudulent-ads-documents-show-2025-11-06/?utm_source=substack&utm_medium=email</span></a></p> @briankrebs@infosec.exchange meta meta meta
Open post gh0sti @gh0sti@mastodon.social · 5mo ago Replying to @zackwhittaker@mastodon.social <p>Ahahaha. GOOD! Finally, I have actual documented proof that these two large handsome cat loaves actually like each other enough to snuggle.</p> @zackwhittaker@mastodon.social why is my cat pictured here?
Open post gh0sti @gh0sti@mastodon.social · 21mo ago Replying to @briankrebs@infosec.exchange <p>If you're an Apple user and I spoof your phone number in a call to the legitimate Apple Customer Support line (800-275-2273), I can force Apple to send you a system level "Apple Account Confirmation" prompt to all of your signed-in devices. </p><p>This approach is commonly used by a prolific voice phishing group to convince targets they really are in a support call with an Apple representative.</p><p>Today's deep dive into this weird world was made possible in part by a series of live phishing videos, tutorials and other secrets shared by an insider that show in unprecedented detail how these voice phishing scams can be so convincing. </p><p>Please share this story widely, because I learned a ton reporting this and frankly the various methods used by these groups to dox and target people are really slick. </p><p>From the story: "Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and Google to force a variety of outbound communications to their users, including emails, automated phone calls and system-level messages sent to all signed-in devices."</p><p><a href="https://krebsonsecurity.com/2025/01/a-day-in-the-life-of-a-prolific-voice-phishing-crew/" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">krebsonsecurity.com/2025/01/a-</span><span class="invisible">day-in-the-life-of-a-prolific-voice-phishing-crew/</span></a></p><p><a href="https://youtu.be/F44un1_y2fs" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">youtu.be/F44un1_y2fs</span><span class="invisible"></span></a></p> @briankrebs@infosec.exchange how does this affect users who have advanced protection on for their iCloud accounts?
Open post gh0sti @gh0sti@mastodon.social · 7mo ago Replying to @briankrebs__dup_6@infosec.exchange A slick new phishing-as-a-service offering demonstrates just how easily a username+password and a one-time token can be phished. Dubbed "Starkiller," the service uses cleverly disguised links to load the target brand's real website, and then acts as a relay between the victim and the legitimate site -- forwarding the victim's username, password and multi-factor authentication code to the legitimate site and returning its responses. https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/ #phishing #MFA #starkiller @briankrebs@infosec.exchange would hosting our own dns like pihole defend against this?
Open post gh0sti @gh0sti@mastodon.social · 47mo ago Replying to @oatmeal@mastodon.social <p>This seems like an appropriate first comic for mastodon.</p> @oatmeal@mastodon.social I look forward to your mastodon humor!
Open post gh0sti @gh0sti@mastodon.social · 18mo ago Replying to @zackwhittaker@mastodon.social <p>Cannot unsee. <a href="https://velvetshark.com/ai-company-logos-that-look-like-buttholes" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">velvetshark.com/ai-company-log</span><span class="invisible">os-that-look-like-buttholes</span></a></p> @zackwhittaker@mastodon.social thank you. I didn’t need this.
Open post gh0sti @gh0sti@mastodon.social · 15mo ago Replying to @zackwhittaker@mastodon.social <p>An iPhone app called ICEBlock, which allows anyone to lawfully and anonymously report ICE sightings and get notified about nearby ICE agents, went viral overnight after criticism from the US Attorney General.</p><p>FYI: The app doesn't collect or store user data. (I checked by doing a network traffic analysis of the app.)</p><p><a href="https://techcrunch.com/2025/07/01/iceblock-an-app-for-anonymously-reporting-ice-sightings-goes-viral-overnight-after-bondi-criticism/" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">techcrunch.com/2025/07/01/iceb</span><span class="invisible">lock-an-app-for-anonymously-reporting-ice-sightings-goes-viral-overnight-after-bondi-criticism/</span></a></p> @zackwhittaker@mastodon.social link to the app?