Mike Sheward on Nostr: Some Plexfiltration Updates: 1) HR department from a Spanish Company sent me an email ...
Some Plexfiltration Updates:
1) HR department from a Spanish Company sent me an email (with high importance) reminding employees of how seriously they take Halloween, and people wishing to enter the costume contest this year should review last years entries to see the standards - followed by a dozen photos of employees in costumes (I included a non-identifiable one). Sent to internaluser.com.
2) I was able to get ahold of the SaaS Vendor security team whose product was sending me AI meeting summaries and financial KPI's from one of their clients (including 1x1's/and leadership team meetings) on Monday, they thanked me for the heads up - yet, two days later....I am still getting said AI meeting summaries to deleteduser.com.
3) What turns out to a massive department store chain in the Philippines is using deleted-user.com for their soft deletes. Got a bunch of mail from them over the past few days.
4) A software developer at a Fortune 500, and one of the worlds most highly recognizable brands just started using internaluser.com as a test account apparently, and now I'm getting dozens of emails containing reports from an internal system about suppliers.
#infosec
Published at
2026-10-28 20:45:51 UTCEvent JSON
{
"id": "54afd2ec8970560ab3f187b363ba0576f85c6542807f126470c9f0816d85094e",
"pubkey": "dd7d3906517e4539fd3ffbebbf2eabba7b4eb9c4d2b7a95a3d2ea96fa86d2cdf",
"created_at": 1793220351,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@SecureOwl/117520488971729548",
"web"
],
[
"t",
"infosec"
],
[
"imeta",
"url https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/520/426/600/219/401/original/c07031ef938972cc.png",
"m image/png"
],
[
"proxy",
"https://infosec.exchange/users/SecureOwl/statuses/117520488971729548",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/SecureOwl/statuses/117520488971729548",
"pink.momostr"
],
[
"-"
]
],
"content": "Some Plexfiltration Updates:\n\n1) HR department from a Spanish Company sent me an email (with high importance) reminding employees of how seriously they take Halloween, and people wishing to enter the costume contest this year should review last years entries to see the standards - followed by a dozen photos of employees in costumes (I included a non-identifiable one). Sent to internaluser.com.\n\n2) I was able to get ahold of the SaaS Vendor security team whose product was sending me AI meeting summaries and financial KPI's from one of their clients (including 1x1's/and leadership team meetings) on Monday, they thanked me for the heads up - yet, two days later....I am still getting said AI meeting summaries to deleteduser.com.\n\n3) What turns out to a massive department store chain in the Philippines is using deleted-user.com for their soft deletes. Got a bunch of mail from them over the past few days.\n\n4) A software developer at a Fortune 500, and one of the worlds most highly recognizable brands just started using internaluser.com as a test account apparently, and now I'm getting dozens of emails containing reports from an internal system about suppliers.\n\n#infosec\nhttps://media.infosec.exchange/infosec.exchange/media_attachments/files/117/520/426/600/219/401/original/c07031ef938972cc.png\n",
"sig": "e7c3c7a7277d82172aa139714c7aa76b7d1b56025226f2fb8fba873463cfb47ac720a63f0ef29e2623435b1c15bfb7f511c411de56f508e3a8ffc3215124643d"
}
