01 / Security response
Following the evidence.
Recovering $10,000.
I investigated an email compromise after a client’s employee scanned a malicious QR code that had passed through their email filter.
Reviewing logs, I found that the attacker had sent several requests to the client’s billing team and created a mailbox rule to hide replies to those messages.
I uncovered the attacker’s activity and recovered $10,000 for the client.
