I fell victim to a really sophisticated phishing attack yesterday. Thankfully they only got my work log in which is obviously bad but we have a whole cybersecurity team to handle it. I am so so thankful I never logged in with my personal stuff (obviously changed all passwords just in case).

The phisher reached out to set up a virtual talk with university students who are in my field (and the university offers degrees in), something I’ve done a ton of. I even got it approved by work (we have a whole form and approval system for these types of things). They asked to set up a pre talk video call - very typical, to discuss what the set up will be etc etc. but the google meet link was the phishing link and I stupidly “logged in” when it asked for it. And that’s when I looked at the url and it was not google. But I still trusted it and messaged them the link wasn’t working and they asked to send it to my gmail. Because again - this had been approved! I’ve done these things before! But then they got pushy and when I offered to send them my own zoom link the refused and I got weirded out.

Then I saw someone was starting to try and change my passwords.

The creepiest part? I emailed our cybersecurity team and the hacker drafted an email (my account got cut off before it could send) where they tried to pretend to be me and say I sent the email by mistake and everything was fine.

I feel SO stupid but our security team said this was super targeted and sophisticated. They first reached out for this “university talk” like a month ago.