Convinced, compromised, and confirmed.

Hacking Humans

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠Dave Bittner⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with a ton of follow-up—from a sextortion scam that triggered a bot frenzy on Facebook, to sandboxed scam-baiting with fake credit cards, to a surprise magazine subscription that may or may not involve chicken gods. Plus, one listener wonders: do people really know what a strong password is? Dave’s story is on a massive China-linked scam where hackers are spoofing big-name retail websites—like Apple, PayPal, and Hermes—to trick shoppers into handing over their payment info on convincing fake storefronts, with thousands of fraudulent sites still live and targeting victims worldwide. Joe's got the story of a sneaky spear-phishing campaign targeting financial execs with fake job offers that ultimately install a legit remote access tool, NetBird, to gain stealthy, persistent access—part of a growing trend where attackers use real software and clever social engineering to fly under the radar. Maria's got the story of a young homebuyer who lost $109,000 to a payment redirection scam, prompting Australian banks to finally roll out a “Confirmation of Payee” system to prevent similar fraud—though critics say the fix still puts too much blame on victims. Our catch of the day comes from the Scams sub-Reddit, where we hear about a scam getting people to click on a fake job that's too good to be true.

Complete our annual ⁠audience survey⁠ before August 31.

Resources and links to stories:

• ⁠China-linked hackers spoof big-name brand websites to steal shoppers' payment info
• Fake Recruiter Emails Target CFOs Using Legit NetBird Tool Across 6 Global Regions
• After Louis lost $109k to scammers, banks are finally combatting the 'flaw' the scammers used

⁠⁠⁠⁠⁠⁠⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.