AI Hallucinations, Smishing Scams, and Fake Banking Apps: Hacking Humans Podcast

AI-Generated Code and "Slop-Squatting"

• 💡 AI-powered coding tools are increasingly "hallucinating" fake software package names, a practice dubbed "slop-squatting."
• 🧠 Developers may unknowingly install these malicious lookalike packages, compromising software supply chains.
• ⚠️ The AI might suggest a non-existent library name, and attackers then create that package with malicious intent.
• 🔍 Google's AI can also summarize these "slop-squatted" packages, falsely praising them as useful and stable.

Toll Road Smishing Campaigns

• 🎯 Cisco Talos has uncovered widespread smishing scams impersonating toll services like Easy Pass across multiple U.S. states.
• 💰 Threat actors use a kit developed by "Wang Duo Yu" to trick victims into paying fake toll fees through spoofed websites.
• 💳 These sites request personal and payment information, including names, addresses, and credit card details.
• 📈 The campaign leverages typo-squatted domains and has been active since October, with kits distributed via Telegram.

Fake Banking Apps and In-Person Scams

• 🏦 Scammers are using fake banking apps to fool sellers in in-person transactions, walking away with goods and money.
• 🤝 Victims meet scammers for transactions, and the scammer shows a fake payment confirmation on their device.
• 📱 The lookalike apps mimic legitimate UK banking apps, allowing scammers to deceive victims into believing payment has been made.
• 📉 In the UK, over 500 reports of this scam have occurred in the last three years, with victims losing significant amounts, sometimes leading to job loss and loss of trust.

"Catch of the Day": Job Scam Smishing Attempt

• 📧 A listener named John shared a smishing attempt disguised as a job offer via email to text message.
• 💸 The message, impersonating a recruiting representative from "Adjust," offers a remote position with high daily earnings and a substantial base salary.
• ⚠️ The scam uses a pre-made kit, evident by the placeholder text "Adjust" remaining in the message, indicating a lack of customization.
• 🚩 The offer requires the recipient to be at least 18 years old and to message a provided phone number to participate.