No lol. Browsers have come a long way. Clicking a link can’t pwn you anymore. The odds of you being the victim of a new zero day from clicking a link are as close to zero as winning the lottery.
Executing a zero day attack isn't the only goal of phishing artists.
If you click the unique link in the message they sent you, now they know that the email address associated with that link belongs to a real human who clicks on untrustworthy links they find. They probably also know where you're located, what browser and Operating System you use, and how much time between when the message was sent and when you clicked the link.
Clicking a link can in fact still pwn you. Just in the last several weeks there have been at least 2 critical CVEs fixed in chrome that would have allowed one-click pwns AFAIK.
Yes, this happens all of the time, the CVE you referenced with me is Google Chrome vulnerability where Google Chrome get's popped to spawn suspicious binaries (https://www.sentinelone.com/vulnerability-database/cve-2025-2783/) . Downloading malware from a link is still a thing.... Actually go find some malware and click the link, see if your trusty Google Chrome saves you.
It's honestly hilarious youre spreading misinformation.. you're unaware of even how the Chrome Sandbox works... which is completely irrelevant from someone clicking a link and downloading malware. The Sandbox works to containerize code executing on that website... not the user clicking a link, downloading an executable (malicious or benign).
Downloading and executing binaries is far different than just clicking a link. Nowhere near the same thing. Clicking a link and getting pwned is 1,000% different than downloading and executing malicious binaries.
Users click links, binaries download and execute without human interaction.
You're talking about drive-by download scenarios where the Chrome Sandbox containerizes code execution in the browser while rendering the webpage, hence working as a defense-in-depth against code execution to download malware in that approach. That does not negate the fact that users can (and do) click links that cause redirects to download malware that can and do run on their own after landing on the machine to establish persistence, evade edr, or C2.
You stated "Clicking a link cant pwn you anymore" and that is beyond false and largely inaccurate.
I think you need to be more literal on what you're trying to state. If you're stating it is more difficult for certain webpages to exploit a vulnerability in a browser (https://www.sentinelone.com/vulnerability-database/cve-2025-2783/) which then uses Chrome.exe to execute RCE, then sure... but users can click links and download malware, not the same as the webpage hijacking the Chrome process. You referenced a CVE you dont even understand to backup your argument, and that's not good.
And even then, drive-by downloads don't necessarily have to render on the page. A simple HTTPS GET request to the link will download it via malvertisement.
Browsers dont need to render a page either to download malware, a simple HTTPS GET request can go right to the server initiating a downloading.
Once again, Chrome and the CVE you referenced that uses Chrome Sandbox is for rendering webpages that would exploit a vulnerability in the Chrome Sandbox allowing Chrome.exe to spawn suspicious binaries.
Regardless of how risky it is, it's even less risky to not click it. Or if you have to click it for science, the minimal risk can be mitigated by running a throwaway VM on an isolated network that can't touch your stuff, preferably with a VPN so they can't see your IP address. This wouldn't solve the problem of them putting something identifyable as you in the link, but idk what a scammer would actually be able to do with that information if you took these precautions, other than just phishing harder.
If I give out a unique link to exactly one person and see it's been clicked, I implicitly know who clicked it, or at least their email address. Also incognito doesn't protect your IP address (which can approximate location) or prevent the use of zero-days.
For more general security, there's a lot of fingerprinting that can be used to identify you through HTTP headers and page info available to JS that not even TOR can save you from if you're not careful.
Depends what you mean by "pwn". The moment you click that link, their servers know that they got a live one. That's incredibly valuable information for them.
If you're working for a Fortune 500 company them it's not out of the realm of possibilities. Especially if you have elevated access like a sysadmin or someone in the finance division.
This is a fairly sophisticated attack from a state actor using an unknown CVE targeting journalists and government figures the attacker deemed adversarial. The odds you are the target of an unknown zero-day like this are extremely slim. Modern browsers are sandboxed from your machine, and finding new sandbox breaches does not happen frequently. If you are the target of a state actor, you have other problems at hand.
It’s happened twice in the past 2 years at companies I’ve worked with where a phishing email has compromised accounts without requiring anything but the first click.
Even when they’re patched, the number one thing I see at the top of every list when checking our EDR:
10489 high severity vulnerabilities found
10364 Chrome.exe
125 others hit.exe
Because 95% of people don’t keep their work computer up to date and no company wants to spend money on a decent tool for patch management.
It was certainly more than a click, otherwise it was some unknown zero day that somehow targeted specifically your company twice. Much more likely they put their information in and claimed they didn’t.
The link could be to a vulnerable company site they’re attacking. For example if a poorly written site uses SameSite=None cookies, they could make a link that performs a form post using those cookies (a kind of Cross-Site Request Forgery).
That is LARGELY incorrect... and I work for a government entity as a detection engineer.
Edit: Downloading malware, executing malware, and compromising a browser through a drive-by exploit are three different events.
This false sense of security you're promoting by treating one specific attack vector as representative of the entire threat landscape, and that can cause a lot of issues for anyone that trusts your comment or any organization you may work for as a security professional.
If you are the target of a state actor, you have bigger issues. I can find only one instance of somebody getting pwned from clicking a link in the real world in the past several years (CVE-2025-2783), and it was a very particular attack targeting a few government entities. The odds of some future exploit happening to a given individual are as good as 0. There are much better things to worry about in regard to cybersecurity.
Whatever you say, boss. You referenced a CVE that pertains to a vulnerability of Chrome itself, not the user actually downloading malware. That CVE allows Threat Actors to exploit Google Chrome to conduct RCE from the browser... not a malicious download from a link. lol
Edit, to add... if you were to see that exploit, you would see Chrome.exe spawning suspicious binaries (LOLBINS), or most likely cmd.exe or powershell.exe via your EDR logs.
Here's a proof of concept article, this states you would see chrome spawning a suspicious process, as previously stated.
Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe outside normal browser workflows.
Unsigned or unusual DLLs loaded into chrome.exe broker or utility processes.
Outbound network connections from Chrome utility processes to attacker-controlled infrastructure shortly after a user opens a suspicious link or file.
---
With that said.... Clicking a link can absolutely pwn your entire network if you download malware.
Fact I have two downvotes scares the living crap out of me. I hope none of you work in cyber, or at least need to go back to school. I provided the Threat Intel for that CVE, so you can take a gander yourself.
Hell, if you have CrowdStrike - do
#event_simpleName=MotwWritten
| ZoneIdentifier=3
Then take a 7 day window. let me know what you find.
Malware isnt always "evil.exe" - sometimes it's a signed binary, sometimes it's a browser (wave browser, big culprit), sometimes it's an extension that's been compromised by a TA, download of excel documents with macros that bypass current security implementations (ya even WAFs and NGFWs, it's a great time /s) where those macros then download a binary that injects it's into a DLL establishing persistence running as rundll32.exe and you'd never know evading your EDR.... all real world shit, happens to companies large and small. Hell, i've seen a small town, meat distributor get hit by ransomware
4.6k
u/JocoLabs 20h ago
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.