ClickFix to BEC: the inbox rule gets the headline, the paste deserves it
I've lost count of how many BEC cases started with someone telling me "I didn't click anything." Okay sure - but what about pasting something? This week, Huntress published a walkthrough of an attack chain that ends in business email compromise (BEC). The specific post is From Overhyped to OH $#!T, and its "star" is Doris Stewart, a made up finance employee at Speedway Laundry. Doris googles ChatGPT for help with an email, clicks a sponsored result, and lands in a custom GPT built by an attacker. The GPT claims there's a service issue and sends her to a fake verification page, which tells her…
