I was seven words away from being spear-phished (robertheaton.com)

Article summary

The author received an email from a supposed University of Cambridge representative asking for help judging an economics prize, but it was later revealed to be a spear-phishing attempt. The attackers had compromised University of Cambridge email accounts and webpages to make the email appear legitimate. The author was lucky to have been using Chrome instead of Firefox, which would have made them vulnerable to a 0-day exploit. The attack was technically advanced and targeted specific individuals.

Main themes

• spear-phishing
• email security
• browser vulnerabilities
• targeted attacks
• academic institution security

What commenters say

• Using a compromised academic institution's domain makes the phishing attempt more credible and increases the likelihood of success.
• The use of a legitimate-sounding domain name could have achieved the same effect without compromising an actual institution's account.
• Some argue that using a separate system or VM for sensitive activities like online banking is a good security measure, while others think it may be overboard.
• There is disagreement over whether this type of attack should still be called 'spear-phishing' when it involves an 0-day exploit rather than traditional phishing tactics.
• Some commenters believe that the term 'spear-phishing' refers to the targeted nature of the attack, regardless of the payload or method used.
• Others think that the term 'phishing' implies a specific type of social engineering attack, and that this incident may require a new term like 'spear-hacking'.
• The effectiveness of security measures like using a dedicated VM or separate system for sensitive activities depends on various factors, including the user's behavior and the potential consequences of a breach.