Hello and welcome to the Thursday, July 2nd, 2026 edition of the Sands Inlet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Riyadh, Saudi Arabia.

And this episode is brought you by the sands.edu created certificate program

in Purple Team Operations. That is a reminder, there will be no podcast tomorrow on Friday,

part because of July 4th, not so, because of my travel schedule. Xavier came across a real

interesting fishing email. Now, this particular

phishing email targets Meta Mask. Meta Mask is an app and a browser extension used for

crypto coins or cryptocoin wallet, and of course, with that an attractive target. But the approach

they're taking here for fishing is a little bit different.

Now, Minamask, like many websites, particularly if they're crypto coin related, does require and

encourage to use multi-factor authentication. So that basically renders some of the simple fishing

attempts useless. But in this particular case, the attacker is going after a secret phrase the user establishes

in order to reset their authentication option.

So when you're signing up for Mehta Mask, as part of the signup process, this secret phrase is established.

It's not used to usually log in.

It's used more as a password recovery token as a backup in case you're losing your username

and second factor.

And that's exactly what the attacker is abusing here.

So essentially the password reset feature.

The problem here, of course, is how do you securely recover an account if the second factor is lost?

A lot of websites and such are relying on a type of sort of one-time password or a secret random string that's established when you're setting up the second factor.

And that, of course, is still fissurable as this particular attempt shows.

...