almost got scammed
Source: YouTube · John Hammond · published Feb 3, 2025 · 20:56
The video details how a security team at Huntress detected and responded to an active scam involving remote control and phishing, using forensic artifacts like unsaved Notepad buffers to identify a scammer in real time. 0:51
Key Takeaways:
• A victim’s unsaved Notepad buffer revealed a scammer typing “do not talk to anyone else” after a call was disconnected, indicating active scammers using remote access 0:51.
• The scam involved a fake tech support email prompting the user to call, leading to a fraudulent screen connect session and a malicious website visit 18:30-18:47.
• Browser history showed visits to a phishing site (jsr care.help) and a Google form collecting personal data, confirming the scam’s intent to extract sensitive information 10:51-11:00.
• The team isolated the victim’s machine to prevent further spread and later contacted the victim via phone after identifying a phone number from the scam site 15:00-15:18.
• The victim was successfully reached and advised to stop all communication with the scammer, notify their bank, and remove malicious software 15:23-15:30.
This real-world case demonstrates how security teams use forensic artifacts and cross-referencing to stop active scams, highlighting the importance of prompt action and victim awareness. 19:44-19:56
Sources:
- 0:51 Discussion of unsaved Notepad buffer revealing scammer’s message.
- 18:30-18:47 Original scam email and victim’s actions.
- 10:51-11:00(https://www.youtube.com/
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
it is story time so if you didn't know I do this YouTube channel thing alongside my day job where I work as a security researcher at Huntress we all work remotely and we use slack to communicate and the other day I got a seemingly random DM from a co-worker of mine in the sock or the security Operation Center he said off the top of your head do you recall where to find unsaved notepad notes on dis I recall a while ago you were able to pull it from somewhere I just don't remember where exactly and I thought oh yeah like I have a YouTube video on this I grabbed the link and I tried to find that timestamp in the video where it has the full path on the Windows File system so I sent that along and sorry the story is going to be told via screenshots he said look cool thank you I knew there was a…