I really can't understand what some people consider trustworthy...
"Attackers would sometimes engage in further communication with the target by attempting to schedule a meeting to discuss the project's design or requirements. The Exotic Lily attackers would then upload the malicious payload to one of the public file-sharing services and use a built-in email notification feature to share the file with the potential victim. By doing this, the final email would originate from the email address of a legitimate file-sharing service and not the attacker's email, making it look more legitimate and easier to evade detection."
How would that seem more legitimate, what kind of organization would really use file-sharing services to keep their internal business documents?
Biting the hand that feeds IT
