Thread by @AvishaiY

Last week, I fell victim to a sophisticated social engineering scam and ended up downloading a trojan. 😔 I feel stupid, but I'm sharing this so you'll be more cautious and vigilant, especially when you're in a hurry.

🧵👇

I always tell my friends and family: NEVER open any link unless you're 100% sure about the URL. But guess what? It was me who slipped up this time. 😓

An account on Twitter that seems completely legit (a verified account with a lot of followers), claiming to work with a (known) VC in its bio, reached out about a potential collab/partnership. After a quick sanity check, I suggested to hop on a call on the spot.

Instead of an immediate call, they scheduled it for a week later and sent me a calendar invite.

Then, 5 minutes before the call, they sent me a meeting link.

Except it wasn’t Google Meet, Zoom, or MS Teams. It was a link to “Brave Talk” — but the URL wasn’t , it had a different domain extension.brave.com

In a rush to not be late, I clicked it. It redirected me to download what seemed like a Brave browser installer. I downloaded the dmg file... but nothing happened — at least nothing visible. That’s when I got suspicious. 🤔

I told them the file didn’t work. They tried convincing me to fix it fast because "others were waiting on the call." They even sent instructions and screenshots and were very willing to help me installing this f*** file. But by then, I knew something was off.

I played along, sent them a Google Meet link asking them to join my call, to stall for time and let them think I'm still with them; then I immediately took the required measurements needed to minimize the impact of the attack (without knowing if it succeeded or not) and checked the dmg on VirusTotal. As I feared, it was a verified trojan. 🛑

Lesson learned: Always be suspicious. Double-check every link. Run downloaded files through VirusTotal or similar tools. Stay safe out there! 💻🔒

Share so no one else falls for it like I did. 🙏 #CyberSecurity #StaySafe #trojan