12 Jul 2026 - AJ
I had a good vacation, and I’m back!
This week’s scam - or rather, phish - is pretty hot off the presses. Injection attacks, where an attacker uses a legit form to send out a phishing link, are not new, and only the part where the attacker (mostly) stays within the Google ecosystem (by leveraging Google Sites) is a new aspect.
I personally find injection attacks both facsinating and horrifying. Fascinating on how they use innocent input forms to spam their attack, and horrifying because these are terrifying. We’ve taught our users to check who’s sending the email, and having it come from a trusted source doesn’t mean anything nowadays.