The best phishing attempt I've ever seen just hit my DMs. A "reporter" at TechCrunch, 10-year-old account, 9k followers, reached out about an article. Sent me to a real cal.com booking link with an actual TC reporter's name on it. After booking, a "verify yourself" page. Auth request looks clean except for a small red note saying it's not approved. Spidey sense kicked in and I caught the sketchy domain. But if I was on autopilot, I'd have handed over full account access without blinking. These aren't Nigerian prince emails anymore. They're using aged accounts, real platforms, and real names. Treat every unsolicited DM from a "journalist" as a threat until proven otherwise.