alt Hacker NewsIt is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
Replies
mrheosuper • today at 2:42 AM
NGL i can see 2 AM, caffeine-fueled version of me fails for this
rddbs • yesterday at 8:58 PM
No, what would be crazy is to think that zero engineers would fall for this.
alala-lala-lon • yesterday at 6:18 PM
[dead]
For people who were newly nervous about clicking an unfamiliar link, this is a blog post describing the initial intrusion - the attackers paid for an ad on Google Search mimicking the homebrew website, which tells you to install it through a script. It's something you might have copied directly into the terminal before.