Internet Week 2026 Session Examines Shifting Phishing Tactics and Multi-Stakeholder Defenses

Security Researcher Earns Second Place in Hackfest Quebec Social Engineering CTF Using Custom Tools

A journalist competed for the seventh time in the Social Engineering CTF at Hackfest de Québec, finishing second among twenty participants. The event required building an OSINT report on 28 companies including Decathlon, Ikea, Air Canada and Home Depot, followed by timed phone calls to extract information from real employees. The competitor developed five custom tools including an intelligent directory, a sound ambiance synthesizer and a private AI for handling objections during calls. Preparation involved a full week of open-source research yielding 95 percent of answers before any calls, with the remaining score determined by 30-minute phone sessions. In the final round the journalist adopted the persona of a union representative conducting a salary survey, drawing on local Quebec media coverage to build credible context. The performance resulted in 39 direct answers from employees out of 67 objectives and reinforced the lesson that tools alone cannot replace human understanding in social engineering scenarios.

Russian Li Auto Owners Lose Master Accounts to Thieves Demanding Up to 45,000 Rubles

Russian owners of Li Auto vehicles are experiencing a wave of master-account thefts that disrupt vehicle functions including infotainment screens, climate control, and in some cases engine start. Attackers then contact victims and offer to restore access for payments ranging from 35,000 to 45,000 rubles. The master account is tied to the official mobile application used for remote vehicle management. Approximately twenty confirmed cases have been reported so far, though the actual number may be higher. The exact infection vector remains unknown, and even owners who previously used the paid eSender service to retain Chinese phone numbers are now affected. Li Auto and its Russian distributor Sinomach Auto are developing both protective measures and an account-recovery procedure that will eventually support email-based binding instead of Chinese phone numbers.

Confession of a Promo Code Abuser: How Russian Marketplaces Lost Millions to Multi-Account Fraud Farms

A detailed three-year account reveals how one operator built a sophisticated promo code abuse operation targeting Russian e-commerce and food delivery platforms. The scheme relied on emulators, virtual numbers, anti-detect browsers such as Dolphin Anty, Octo and AdsPower, mobile proxies and physical SIM banks to register thousands of new accounts and extract discounts up to 80 percent. Early success gave way to advanced defenses including Device Fingerprinting, behavioral biometrics and graph-based geolocation analysis that detected mechanical clicking patterns and repeated delivery coordinates. Banks applying 115-FZ rules began freezing accounts, while retailers escalated cases under Article 159.6 of the Criminal Code for computer fraud and Article 187 for illicit payment instrument turnover. The operator eventually dismantled the farm after observing colleagues receive prison sentences and massive civil claims. The story illustrates the rapid evolution of corporate anti-fraud systems and the shift from low-risk arbitrage to criminal liability.