56 - Please, Download Our Exploit

The Binance theft had us thinking back to an incident that happened recently, and the pattern of security attacks playhaus' has been experiencing since the Coinbase hack.

A few weeks ago, Connor (el Prof) was invited to be on a Coindesk podcast over LinkedIn, it looked really convincing, he's done them before. Until the email that scheduled the interview came through. It didn't match a domain (url) that'd be associated with Coindesk. 
Curious, Connor hopped on the call, where the scheduler remained off camera, and what he assumed to be an AI host joined. He was told the interview was actually going to take place in another tool, and provided a software to install to use it.
We nearly handed over everything sitting in his browser to an app that would have swept every wallet, every seed phrase, and every key on his machine. He caught it. Statistically speaking, most people don't.

Here's the part that should bother you: there was very little to catch outside of inution. Most of the tells were dead. Fortunately their playbook was limited an a google search revealed a read thread discussing the scam.

Near identitical to the social phishing responsible for the Binance exploit. SlashNext logged a 1,265% jump in malicious phishing emails in the year after ChatGPT shipped, with credential phishing up 967% and roughly 31,000 attacks going out daily. 

Volume is the boring half, though. The scary half came from a controlled study by Heiding, Schneier and Vishwanath, validated on live human subjects: fully AI-automated spear phishing hit a 54% click-through rate, dead level with emails written by expert human attackers, against 12% for the generic stuff.

Expert-grade attacks, at spam economics, produced faster than you'll finish this paragraph. The one thing that used to keep sophisticated phishing rare, a skilled human paying attention to you specifically, is no mostly gone. So what does the new playbook actually look like? Three moves, mostly.

• The first is polymorphic text: legacy filters match signatures, known phrases, repeated templates, and an LLM simply writes a structurally unique message for every single recipient. Ten thousand emails, ten thousand different texts, one payload, nothing to blacklist. 
• The second is conversation hijacking, which is nastier. Attackers stopped opening conversations. They take over a mailbox or a Telegram account, read the thread history, and slot themselves into an ongoing relationship with the right names, the right context, the right callbacks to last Tuesday. You're not evaluating a stranger anymore. You're answering a colleague. 
• The third is voice. Three seconds of audio gets you roughly an 85% match per McAfee's testing, and executive voices are lying around in public on earnings calls, keynotes and, yes, podcast archives. Vishing incidents jumped 442% between the first and second half of 2024. One deepfaked video call cost the engineering firm Arup $25.6 million.

Crypto is where all of this lands hardest, because we're the vertical where a single bad click is final. 

On September 18, seven agencies across Japan, the U.S., Australia and Germany put out a joint advisory on WaterPlum — the DPRK crew the security world knows as Contagious Interview. Between December 2025 and July 2026 they infected more than 30,000 devices in over 100 countries, pulled funds or credentials from 7,000-plus wallets, and moved about $10.71 million home to Pyongyang. The lure was a job. A recruiter message, a technical interview, a coding test to download, or a “fix” for the video call that mysteriously won't connect. Separately, security researcher Taylor Monahan has tracked over $300 million stolen through fake Zoom and Teams meetings run off hijacked Telegram accounts and looped footage from real interviews — your compromised session then gets used on your friends, which is why the damage compounds across a network instead of stopping at you.

Connor got out because something about that download prompt felt off. Respect to the instinct, but instinct isn't a control, and the next one will be smoother, better timed, and speaking in a voice you recognize. Stop asking whether you'd catch it. Start asking what happens on the day you don't. Certainly there's something to be said about better security hygene and practices, but stay safe out there.

— Muhammed, el Prof