Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

151–160 of 267 posts

Re: The scariest "user support" email I've received

#151

Post by userbinator »

lvzw wrote: post #8

> Phishing emails disguised as support inquiries are getting more sophisticated, too. They read naturally, but something always feels just a little off — the logic doesn’t quite line up, or the tone feels odd. The phrase "To better prove you are not a robot" used in this attack is a great example. Easy to glance over if you're reading quickly, but a clear red flag.

"I don't have to prove anything. Fuck off." is my normal response to being presented with CAPTCHAs or other "challenges" unexpectedly.

Re: The scariest "user support" email I've received

#152

Post by theturtlemoves »

epaga wrote: post #148

I’ve always wondered why spam and scam emails have been so…dumb and obvious… 99.9% of the time. It does seem like AI may change this and if even the tech savvier ones among us are able to be duped, then I’m getting worried for people like my parents or less tech savvy friends… we may be in for a scammy next few years.

I once read the hypothesis that if you're spamming, scamming and phishing, you're trying to trick people who aren't paying attention, are inexperienced and are curious. For that target group, the exact text doesn't matter. In fact, the more you do your best to make the email look professional, the sooner the people who are good at filtering signal and noise, will call you out. There might be an advantage to looking like an inept predator: the real watchmen will shrug and think "who would fall for that?"

Re: The scariest "user support" email I've received

#153

Post by userbinator »

frenchtoast8 wrote: post #19

I'm seeing a lot more of these phishing links relying on sites.google.com . Users are becoming trained to look at the domain, which appears correct to them. Is it a mistake of Google to continue to let people post user content on a subdomain of their main domain?

It's a mistake of Google to obfuscate URLs in their browser so much that it's hard to tell what the actual site is.

I find this 7-year-old comment particularly ironic: https://news.ycombinator.com/item?id=17931747

Re: The scariest "user support" email I've received

#154

Post by userbinator »

Weird already — because my app’s website, https://www.inkdrop.app/, doesn’t even show a cookie consent dialog. I don’t track or serve ads, so there’s no need for that

What I would do in this situation: check to make sure that my site hasn't been hacked, then tell the "user" it's not a problem on my end.

The class names in the source code of the phishing site are... interesting. I've seen this in spam email headers too, and wonder what its purpose is; random alphanumerics are more common and "normal" than random words or word-like phrases. Before anyone suggests it has anything to do with AI, I doubt so as I've noticed its occurrence long before AI.

Re: The scariest "user support" email I've received

#155

Post by bilkow »

Levitz wrote: post #72
wvbdmp wrote: post #67

In Windows CMD you don’t even need to hit return at the end. They can just add a line break to the copied text and as soon as you paste into the command line (just a right click!), you own yourself. I have one question though: Considering the scare-mongering about Windows 10’s EOL, this seems pretty convoluted. I thought bad guys could own your machine by automatic drive-by downloads unless you’re absolutely on the l…

>What’s with all the “please follow this step-by-step guide to getting hacked”? Far from an expert myself but I don't think this attack is directed at windows users. I don't think windows even has base64 as a command by default?

There's a variant of these for Windows: https://www.malwarebytes.com/blog/news/2025/03/fake-captcha-...

It involves no CMD though, it's basically just Win+R -> CTRL+V -> Enter

Re: The scariest "user support" email I've received

#156

Post by croes »

Legend2440 wrote: post #100
croes wrote: post #89

Earlier quoted context omitted.

ChatGPT didn’t download anything, hopefully. The we’re cooked refers to the fact of using ChatGPT to decode the base64 command. That’s like using ChatGPT to solve a simple equation like 4*12, especially for a developer. There are tons of base64 decoder if don’t want to write that one liner yourself.

So what? Why not use the everything machine for everything? You have it open anyway, it’s a fast copy-paste.

Let‘s take a sledgehammer to crack nut. I guess the next step is: ChatGPT, how much is 2+2?

No wonder we need a lot more power plants. Who cares how much CO2 is released alone to build them. No wonder we don’t make real progress in stopping climate change.

What about the everything machine called brain?

Re: The scariest "user support" email I've received

#158

Post by mcherm »

userbinator wrote: post #151
lvzw wrote: post #8

> Phishing emails disguised as support inquiries are getting more sophisticated, too. They read naturally, but something always feels just a little off — the logic doesn’t quite line up, or the tone feels odd. The phrase "To better prove you are not a robot" used in this attack is a great example. Easy to glance over if you're reading quickly, but a clear red flag.

"I don't have to prove anything. Fuck off." is my normal response to being presented with CAPTCHAs or other "challenges" unexpectedly.

Interesting. I wonder how you even manage to utilize the modern web.

Re: The scariest "user support" email I've received

#159

Post by croes »

lukeschlather wrote: post #140
flexagoon wrote: post #124

Earlier quoted context omitted.

Huh? How would decoding a base64 string accidentally run the payload?

I'm copy-pasting something that is intended to be copy-pasted into a terminal and run. The first tool I'm going to reach for to base64 decode something is a terminal, which is obviously the last place I should copy-paste this string. Nothing wrong with pasting it into ChatGPT. When I come across obviously malicious payloads I get a little paranoid. I don't know why copy-pasting it somewhere might cause a problem, but…

So you are less confident pasting it in https://www.base64decode.org/ than in https://chatgpt.com?

That makes no sense.

Re: The scariest "user support" email I've received

#160

Post by meander_water »

mort96 wrote: post #157

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/pasting what a chat bot said. There is no reason to rely on a chat bot for this.

Yeah I was hoping to see the actual script content
Post reply on HN