tzcolors

🚨🚨🚨Founders watch out 🚨🚨🚨 phishing attacks are getting more and more targeted. Here's the scheme you should be aware of: 1. random person impersonating partner/CEO of large VC firm reaches out and shows interest (like many also legit people do). 2. starts a conversation and heavily utilizes GPT to personalize messages. 3. wants to schedule a call, sends you an invite. 4. when meeting is supposed to happen you try to open the link of their custom video call tool, it says "access denied, your IP is restricted" as many such tools do. 5. as you don't want to be late you reach out and tell them. 6. they say, it's a common issue. Their technical team will help. 7. you receive a new link which is supposed to be the "script allowing your IP". 8. they will send you a screenshot of the "ongoing call", putting a bit more pressure on you. The execution of the script is the catch here... It installs directly malware and leverages a privilege escalation exploit (yes also on Mac OS). Moral of the story: GPT makes spear phishing highly effective and founders are a great target because by nature they are looking to expand their network with new/unknown people. Telegram is also quite instrumental to this attack, because there is no protection against impersonation. One way to protect yourself against this attack is first and foremost: to be aware. But then try have a routine to move the conversation over to more verifiable channels like email. But even there: be aware that spoofing the sender of the email is easy and so is purchasing a similar looking domain. Stay safe.