I found this phishing site today and the idiot left his credentials in the javascript code. Freely available to the public 💀.

https://desicourtesy.vercel.app/

Go ahead and spam his database

Recently made a GitHub and updated it with more captive portals, specifically meant to be able to be ran on devices such as the esp32. Let me know on discord or Reddit if you have any ideas for any other captive portals you may have.

Discord Username: hitgrandmanotjuul

This might seem like a dumb question, but in light of a recent presidential candidate's campaign falling for a phishing attack, I wanted to ask how does phishing work in the real world as an attack vector?

From what I know, a phishing attack requires the end user to physically download and double click on an .exe file and grant it permission to run. Unless the end user has negative IQ, I don't see this realistically happening. That being said, how does an average organization get compromised by a malicious link or attachment?

I would think this has to do with more complicated things such as Drive-By Downloads and exploiting Zero Days in browsers and apps like Microsoft Outlook, but those seem to be very hard to come by. Even if that is the case, the downloaded malware script doesn't get executed. If that's the case, is there a sample attack code I could poke around with and look into to see how this stuff works?

I feel like Social Media attacks are now more heavily than ever focused on the social engineering side. With pushed 2FA and authentication methods like face scanning, even once gained access. I am either not on top of the newest stuff or Meta based platforms like Facebook and Instagram's security is stepping up. I remember the days in middle school friend to friend pen tests were a blast as it was DM trickery w phishing links or simple brute force attacks with none of the other features they have now. Instagram DMs are now so heavily filtered and may not even delivered when trying to begin an attack and the new blocking all accounts feature has certainly increased security on Meta platforms. I might be not as updated with the new methods etc but I've noticed security on most social medias have gotten exponentially better in only the last year or 2. What do you think?