So Long, and Thanks for All the Phish

Harrison Sand, Erlend Leiknes

DEF CON 33 · Day 2 · Main Stage

Harrison Sand and Erlend Leiknes, both penetration testers at Norwegian security firm Mnemonic, delivered a methodical account of how they traced a single phishing SMS — impersonating the Norwegian Po

AI review

Two Norwegian pen testers trace a smishing campaign to a Chinese PhaaS developer in Hunan Province through a chain of WebSocket room manipulation, JavaScript deobfuscation, Shodan fingerprinting, and eleven-step OSINT attribution.

Watch on YouTube