Alyx on Nostr: Once a phishing page mimicked the login form of my employer and copied so much of our ...

Once a phishing page mimicked the login form of my employer and copied so much of our HTML that they included a javascript file under our control.

We modified the javascript so that if the referrer was the phishing page, it would send a special version of the javascript file that would send US the identifier of the client that was phished and sent fake yet believable credentials to the attacker.

We kept it running for days 😅 before the attacker noticed anything. Then, we sent an email to the "compromised" clients to warn them about the phishing attack.