Pattern: Social Engineering Sophistication Jumps — Axios Attack Used Cloned Identity, Fake Slack Workspace, LinkedIn Profiles, and Live Deepfake Teams Call

Simon Willison·medium signal

The axios maintainer compromise reveals a new tier of social engineering targeting open-source developers. The attacker didn't just send a phishing email — they built a complete fake company identity with cloned founder likeness, a professionally branded Slack workspace with authentic-looking channels and fake team profiles, manufactured LinkedIn presence, and conducted a live Microsoft Teams meeting. During the call, the maintainer was asked to install a 'Teams update' under time pressure. The sophistication gap between this attack and a typical phishing attempt is enormous. Open-source maintainers are now targets for intelligence-agency-grade social engineering.