My friend owns a circus performance company, and she got a very real-seeming request to discuss a possible wedding gig. "Client" requested that she join a meeting link at h​tt​p​s:/​/​joininivite​.​es/egooglemeet​.​us to discuss (several zero-width spaces are pasted throughout that to make it unclickable). Friend joined the call and it asked her to update software in order to join, she didn't follow any links from the site directly but tried updating Chrome through Microsoft Store etc. This sounded fishy to me so I asked to see the URL and this definitely seems like a scam.

This seems extra concerning because:

1. Initial outreach from scammer seemed genuine even when I read it specifically looking for signs of phishing
2. Initial outreach from scammer was specifically tailored to friend's website content, this is exactly the kind of gig she would get booked for
3. There were several back-and-forth legit-seeming emails before any meeting was agreed to

Friend now wants to make a post within her artist community to protect others and I'm wondering if anyone has already heard of this particular type of attack and has additional details that could help for informing non-tech-savvy performers about it (more specific than "have intuition about when URLs seem dodgy and never click install links that originated from email")

In a moment of distraction, I fell for a phishing phone call and compromised my Google account. It took me 13 minutes to realize how catastrophically stupid I am and begin frantically changing passwords. I've run the official Google "secure your account" process probably 10 times (though 9 of those times there was nothing to do). I've checked all my financial info, changed passwords on all sorts of things. As far as I can tell, other than gaining access to my Gmail, I don't think anything else was compromised.

How boned am I? I've got 2FA on basically anything remotely important, and I've had decent password hygiene (although I do use the Google password manager, so that's probably comprimised). Is there something else I should do or be on the lookout for?

Got this phishing SMSmessage today. I spun up a VM and investigated the domain provided in the message. Found the provider and reported it to them.

The phishing page is a replica Coinbase login page.

https://imgur.com/a/ZSzNKO7