Choc Chip Camo Pants📶

A phishing email.

A not very sophisticated phishing attempt, but sometimes simplicity wins. I received this to one of my personal email boxes on my personal domain.

A simple construction of email to the domain.

The link off-site went to a very simple self-constructing site that would have used an external resource (image.thum.io) to capture a root window snapshot image of the site to place under the "login" box. The email address was in the GET parameters (and the displayed company name inferred, very simplistically, from the domain part).

Absolutely not enough to catch me out, but someone less fastidious? In these times of economic stress for many, a message like this is going to raise the stress even more, and play on emotional cues (fodder to the con artist).

It's easy to say "ah, but that's so obviously a phish I wouldn't fall for it". I have news for you - scammers don't care how often they fail and YOU are not the target. The busy person at the bottom of the food chain, who may not be quite so observant or fastidious, is.

It behoves us to make everyone in every organisation aware of the risks.

The question people often ask is "Why me?" The answer is simple: because they can. Because you are there. Because any foot in the door is a start. The attacker can investigate what facilities and people they have access to. Maybe nothing. Maybe something. And at least they might have access to an email account they can use. Ingres - Investigate - Pivot.

PS: apologies to anyone offended by the test email address I chose to use, but I wasn't going to validate their records with my own.

From Brian Krebs via LinkedIn:

The Great Firewall of China has apparently experienced a great data spill. > 500gb of source code, work logs and internal communication records were leaked. Some light reading for the weekend /s

BTW #3 is probably worth paying attention to here: "3. Safety Considerations
Due to the highly sensitive nature of these leaked materials, we strongly advise anyone who chooses to download and analyze them to take proper operational security precautions. It may be possible that these files may contain potentially risky content and accessing them in an insecure environment could expose you to surveillance or malware. Please consider analyzing these files only in an isolated (virtual) machine without internet access."

https://www.linkedin.com/posts/bkrebs_geedge-mesa-leak-analyzing-the-great-firewall-activity-7372647747587444736-NiUQ

More information on the #npm #malware insertions: More information: https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/

bleepingcomputer blocking TOR access. Helpful...

From @krebs_on_security_feed@noc.social https://krebsonsecurity.com/2025/09/self-replicating-worm-hits-180-software-packages/ Credential stealing "Sha-Hulud" NPM worm got a leg-up when it infected CrowdStrike packages.

According to a recent CNN report (https://edition.cnn.com/2025/09/13/tech/facebook-settlement-payments-privacy-breach) the settlements from the Facebook/Cambridge Analytica class action suit are due to be paid out. Apparently those whose claims are approved will be "notified by email up to four days before their payouts are issued" and funds will either be banked directly or sent "via PayPal, a virtual prepaid Mastercard, Venmo or Zelle."

Can you guess what the next hot new phishing campaigns are going to be...?