2026-02-24 05:09 UTC
Replies (1)
-
@admin@mastodon.slightlycyberpunk.com 2026-02-24 13:00
@3x10to8mps@mastodon.social @briankrebs@infosec.exchange I think "compromised" generally implies that someone has gotten access to the servers or other internal systems, but that's not what this is. Which is part of the problem. A list of affected websites won't do you any good because they could have a dozen new fakes set up the next day. That scale is the only thing that is new here. You *can* tell the difference if you examine the URL carefully and if you know what to look for. They just have tricks to make it look right at a glance. Like using that "@" symbol -- that's not used much these days so a lot of folks won't be familiar with it, but the site you are actually visiting is whatever comes after it. Whatever is before the @ is a username it is sending to that website.