Scam ads in AT&T Yahoo Mail posed as Microsoft security alerts

·2 views

Sponsored messages in the AT&T edition of Yahoo Mail directed some readers to a fake Microsoft security warning that urged them to call a support number. Researchers traced two scam operations running through the same ad slot on October 7 and 8, 2026, with one also appearing in a Taboola ad on September 24. The scam kit behind one of the ads was found on 536 cloud hostnames between July 12 and October 10, 2026, along with 160 phone numbers. The fraudulent content appeared only for visitors arriving through fresh ad clicks on home broadband and mobile connections, while visits from data centers received unrelated articles. Taboola, which sells native ads across Yahoo's sites, has not been reported as responding to the findings in this account.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Every Engineering Project Must First Justify Its Existence

The article argues that before any architecture or deployment work begins, teams should ask whether a given artifact needs to exist at all. It uses an apple as an analogy, noting that the eaten fruit rests on a vast web of trees, pollinators, farming, transport, and digestion that is easy to overlook. The author suggests that judging a system by its visible output alone understates the dependencies beneath it. The same reasoning applies to small software tools, which appear cheap but require tests, releases, documentation, and ongoing maintenance. The piece concludes that underestimating these hidden dependencies is a common planning mistake.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing Deploy-Time 502 Errors in Cloud-Migrated Node.js Services

Teams migrating services to the cloud often see brief 502 error bursts during every deploy. The cause is usually that the service lacks proper health checks and does not shut down gracefully when it receives SIGTERM. Because the orchestrator and load balancer signal removal at different times, requests can reach a process that has already exited. Missing readiness checks and a mismatch between Node's keep-alive timeout and the load balancer's idle timeout cause further errors. Repeated failures lead teams to deploy less often and tolerate noise, which makes releases riskier. The article recommends separate liveness and readiness endpoints along with graceful draining, though serverless platforms and single-instance setups may not need this.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rewording README and docs text so developers can follow it

Most documentation is accurate but written by authors who know the code too well to notice where newcomers get lost. Rewording should focus on the README intro, function descriptions, error messages, and jargon, since those are what readers encounter first or when something breaks. Before editing, exact identifiers like function names, flags, environment variables, and version numbers should be marked and kept unchanged so the surrounding prose can be rewritten safely. A good intro should state in two or three sentences what the project does, who it is for, and why to keep reading. Error messages should explain what went wrong and what to do next, and internal shorthand or unexplained jargon should be replaced with plain terms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Env-Secrets-Scanner Skill Flags Exposed Credentials Before They Reach Git

A new env-secrets-scanner skill for Hermes AI is designed to catch leaked credentials such as .env files, private keys, and API tokens before they are committed to a repository. It uses a dependency-free Python script that runs offline and detects common secret patterns, including GitHub, Slack, Stripe, AWS, Google, and JWT tokens, as well as credentials embedded in URLs. The tool skips template files like .env.example and ignores build folders, and it masks any findings in its report so results can be shared safely. Developers can run it on a whole project, only staged changes, or as a pre-commit hook, with exit codes suited to CI/CD pipelines. The skill is available on GitHub through the hermes-skills repository.

0 comments Read more at DEV Community