27

I just wanted to draw attention to the fact that a possibly dangerous form of spam/cyber-attack has occurred here, and warn our users to watch out for any reoccurrence. Our spammers and trolls seem to always come back.

A late answer(since deleted) on an old question from a user (since destroyed) Mel, claimed to be a photographer who was angry over the sites use of their photographs without permission, and provided a link to prove the photos were theirs. This is a known attack form, though usually occurring in email. If you search the web using 'Mel Photographer phishing' you will see numerous reports matching this, most from June. The problem is that just clicking on the link may open you to a dangerous attack.

From an article concerning this at insercorp.com in June:

Phishing Advisory: Beware of Fake Email from "A Professional Photographer" claiming Copyright Infringement

The malicious actor is pretending to be a "Professional Photographer" or "Licensed Photographer" and going by the name "Mel" or "Melinda" with variations on the last name is using different fake email addresses and providing different fake phone numbers (generally with a '718' area code).

Once the recipient clicks the link it will take them to a file download that will allow the hacker to seize control of the user's device. The hacker will then be able to hold the user's device hostage and demand a ransom or exploit access to the users' system leading to further damage, compromised accounts, or injection of worms (viruses that infect the host machine and use it to launch attacks on others).

So if any of you see a repeat of this attack, please flag the answer, but don't click on the link.

(Also any advice on how to deal with a possible hacker intrusion, or at least advice on which SE forum to look for guidance will be greatly appreciated.)

UPDATE: I see new activity by this scammer today on this question so wanted to bump this so new users will be aware.

Sorry if this is off topic...

7
  • 3
    I've deleted the link from the deleted answer. Thank you for bringing this to our attention.
    – MCW Mod
    Dec 10 '20 at 20:04
  • 3
    Is this worth bringing up on the main Meta? Especially since this turns out to be happening across the network?
    – Chipster
    Dec 11 '20 at 3:25
  • It seems that Glorfindel is indicating a site-wide awareness of the issue in his answer. I don't know that enough general users go the main Meta until after they have a problem for a warning placed there to be of any use.
    – justCal
    Dec 11 '20 at 13:59
  • 1
    If it's been occurring for months (on the internet in general), that's rather scary! Jan 3 at 5:50
  • I have noticed three more occurrences on the History stack since posting this warning.
    – justCal
    Jan 3 at 13:22
  • "the link it will take them to a file download that" my browser will ask me if I want to download, right? Assuming I've never told my browser to 'always do anything' with any file type.
    – Mazura
    Jan 8 at 1:11
  • @Mazura Check the link to the security site I provided for more information. The way I read it you don't have to actually accept a download, its automatic. (My parenthetical request for more technical information on such threats was unfortunately not responded to, so we will just have to rely on external information)
    – justCal
    Jan 8 at 19:03
15

Thanks for your concern. Charcoal, the volunteer organization for keeping Stack Exchange free from spam, already detected this attack, since it's rather prevalent across the Stack Exchange network. Posts like these are therefore likely to attract spam flags from all kinds of users across the network, not just members of this community. Still, it's likely that these posts are around for more than 30 minutes, so any spam flag on them is welcome.

1
  • 2
    Thanks for the reply. The answer had been deleted by 'Community' after one user moved to delete. Leaving that link active seems like leaving a loaded gun laying around though. One of the security sites I looked at had several comments about recent activity from this week, so I hope your algorithms are fired up and ready to go.
    – justCal
    Dec 10 '20 at 21:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .