Hacker News new | ask | show | jobs
by michaelt 764 days ago
If I was the attacker, I'd use credential-stuffing or something to get access to some random employee's account. Doesn't have to be anyone important.

Then I'd set up a short-notice multi-way meeting between the target, the CEO and the hacked account. The deepfake 'CEO' then turns up with no alarms raised, except one wrong name - easily dismissed as a glitch, or an assistant having booked the meeting.

3 comments

So your method assumes you can easily take over an employee account? Isn't that the hard part?
Employees are typically the weak point in corporate security.
$10k/week in crypto lets you easily 'hack' a random corporate account
But that CEO account would be marked as (guest/unverified) in Teams or Zoom.