PSA: I just survived the best phishing attempt I've ever seen.
A "reporter" at TechCrunch with a 10-year-old account and 9k followers DMed me asking if I'd be interested in giving input to an article that sounded relevant. When I said yes, they sent me to a real
cal.com link to book with the name of an actual TC reporter. After booking, I got redirected to another page saying I had to verify myself to complete the booking. The auth request looks somewhat legit, except for a small red note that it's not approved.
My spidey sense had been tripped and I realized the domain was sketchy, but if I wasn't on autopilot (or if I was an OpenClaw) I might have easily given them full access to my account.
Stay safe out there.