Next JavaScript app is hacked, you just don't know it yet
https://audits.blockhacks.io/audit/your-next-js-app-is-already-hacked
#HackerNews #NextJavaScriptApp #Hacked #CyberSecurity #WebDevelopment #JavaScript #SecurityAwareness
Michael Dexter
boosted
It's time for today's edition of #SpotThePhish! Can you spot the many tells in this very bad phishing email that made it through my spam filters today? Spoilers in the replies, so write down your answers before reading on so you can score yourself.
🧵 1/?
#phishing #infosec#securityAwareness
![Phishing email ostensibly from Wells Fargo
From: Wells Fargo Support <info@thetechtales.com>
To: jik@[elided] 5:39PM
Subject: Action Required: Account Access Disabled
DKIM: Invalid (Signature is wrong)
Dear, User,
Your Wells Fargo account requires immediate attention. Due to recent issues detected on your account, we have temporarily disabled access to ensure the security and integrity of your information.
To restore access, please sign in hitps://wellsfargo.com to your account and complete the necessary verification process. This step is essential to confirm your identity and address any potential concerns related to your account activity.
Thank you for your prompt attention to this important matter.
Wells Fargo | Security Center | Contact Us
Wells Fargo Bank, N.A. Member FDIC.
Equal Housing Lender
PM-09282026-7793084.1.1
LRC-0325
©1999 - 2025 Wells Fargo. NMLSR ID 399801](https://cdn.masto.host/federatesocial/media_attachments/files/115/063/742/739/656/809/original/e99f9036d864e145.png)
It's time for today's edition of #SpotThePhish! Can you spot the many tells in this very bad phishing email that made it through my spam filters today? Spoilers in the replies, so write down your answers before reading on so you can score yourself.
🧵 1/?
#phishing #infosec#securityAwareness
Looks like the "Verify your fedi account" scam is gaining pace, & evolving to look more real.
Your server admin will not ask you to click a link to verify your account. And no other admin from any other server will either, even if they do look like they could be part of the main Mastodon team. It's a scam.
Please report any post or DM that urges you to click any link to verify your account.
If you've any doubts about your account, now or on any other day, contact your server admin or mod team.
@Kitty It makes sense to try phishing attacks on Mastodon users. But, apart from "account verification does not exist as a concept here", are there any other indices to spot to detect such scams? What should users generally beware of to not fall for phishing attacks here?
/cc @ela & @quintessence ^^?