Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crates.io phishing attempt

fasterthanli.me

Post reply on HN
Print view View original

11–20 of 83 posts

Re: Crates.io phishing attempt

#11

Post by stravant »

coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

People realized that past phishing attempts were quite badly constructed and a well constructed one is actually really easy to fall for.

Re: Crates.io phishing attempt

#12

Post by diggan »

Workaccount2 wrote: post #10
coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

The worst (or best, I suppose) thing about phishing is that it automatically filters in the fools for you.

Is that different from other types of scams? You could say the same about most of them, they automatically filter away people not falling for it?

Re: Crates.io phishing attempt

#13

Post by diggan »

stravant wrote: post #11
coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

People realized that past phishing attempts were quite badly constructed and a well constructed one is actually really easy to fall for.

> and a well constructed one is actually really easy to fall for

It really shouldn't though, and something you need to be personally responsible for. If it's still possible in 2025 for you to fall for phishing attempts, you're missing something, something that starts with a p and ends with a assword manager.

Re: Crates.io phishing attempt

#15

Post by khy »

coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

A little thing that doesn't help the situation is when legitimate emails link you to domains that aren't obviously controlled by the company.

For example, yesterday at work I got an onboarding email from Lattice (lattice.com) with a link to latticehq.com, which triggered my phishing instincts before I remembered that was their old domain.

Re: Crates.io phishing attempt

#16

Post by kannanvijayan »

coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

Pure speculation - but I'm wondering if one or a few of the black hat players has figured out a good way to leverage AI to phish more effectively at scale, and are taking a stab at all the venues that host code that's within a lot of dependency chains.

Re: Crates.io phishing attempt

#17

Post by stusmall »

coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

It never became unpopular. It's one of, if not the, leading cause of compromise.

Re: Crates.io phishing attempt

#18

Post by oguz-ismail »

diggan wrote: post #13
stravant wrote: post #11

Earlier quoted context omitted.

People realized that past phishing attempts were quite badly constructed and a well constructed one is actually really easy to fall for.

> and a well constructed one is actually really easy to fall for It really shouldn't though, and something you need to be personally responsible for. If it's still possible in 2025 for you to fall for phishing attempts, you're missing something, something that starts with a p and ends with a assword manager .

Nah, I can manage my own ass words. I wouldn't trust a third party have access to all of them anyway

Re: Crates.io phishing attempt

#20

Post by ranger207 »

If you get a message (text, email or call), it's best to not trust the contents of the message until you verify it by logging in or whatever yourself. If crates.io says you have a problem, close the email and go to crates.io yourself. If your bank calls you, hang up and log in or call their support number yourself. Don't trust anyone contacting you for sensitive stuff
Post reply on HN