I immediately alerted Dropbox and Vercel’s security teams so they can hopefully take these accounts down before they snag someone. Sadly, they also were impersonating an unspecting development shop owner as part of the ruse.

Is there a reason not to involve law enforcement in this case? Seems like the author could have been significantly harmed if they weren’t already aware of this attack vector.

score 1 · canonical