A SNEAKY PHISH JUST GRABBED TROY HUNT'S MAILCHIMP MAILING LIST

Summary from the TLDR InfoSec newsletter

Troy Hunt of Have I Been Pwned recently fell for a phishing email that claimed his Mailchimp privileges were restricted, redirecting him to a site that stole his login and MFA code. The email's legitimacy was convincing, and fatigue combined with Outlook for iOS not displaying the email address contributed to his error. However, 1Password's lack of autofill should have prevented it. Hunt also questioned why Mailchimp kept unsubscribed emails and has added the breached email list to his site.