A Word of Caution

What in the spear-phish is going on?

(Edwin Rosskam/Library of Congress, Prints & Photographs Division, FSA/OWI Collection)

SOMETHING VERY PHISHY is going on. Over the last month, my email address has been the target of a series of stunningly well-researched and targeted spear-phishing attempts.

Since March 4, 2025, I've been busy fighting off a stream of spear-phishing emails that were all sent from the apparently hacked email accounts of editors at local outlets and representatives from local PR firms and businesses that I've either worked with or interacted with professionally over the last several years, as a photographer or reporter. The email addresses all appeared to be genuine, not spoofed.

The emails attempted to get me to click links to view or download “proposals” related to photo shoots, reporting projects or quotes, depending on the sender. It’s been creepy and unnerving, particularly because of how personal the senders they chose felt.

A screenshot of a portion of one of the emails sent from an editor’s account, trying to entice me to open a “magazine cover proposal.” (Images disabled for safety; name of the editor redacted for privacy)

Several unsuccessful attempts at logging into my computer account also appear to have been made by someone other than myself in the last week, from seemingly random foreign countries; according to my logs, they didn’t get in. An attempt to “eavesdrop” on my text messages was also potentially made mid-month, but was thwarted.

Thankfully, I never clicked on any of the links or downloaded any of the files I was sent (mostly thanks to an anti-phishing training that I took years ago). But four people at four different local outlets and businesses have apparently been hacked by a mysterious bad actor attempting to socially engineer their way into the inboxes of local media professionals in Metro Detroit, and I'm shaken by it. I also can’t make sense of what is happening, or why.

Still, I’m deeply thankful for the knowledgeable I.T. and digital security experts who made time to assist me with all of this. Their support has been invaluable, and I’m grateful that the good side of the tech community has created resources for people in need of help with technological issues they aren’t equipped to deal with alone.

A screenshot of a portion of another email sent from a different editor’s account, this one trying to lure me with a project. (Name of editor redacted for privacy)

Because of these experiences, I wanted to take the opportunity to preach the importance of learning about online safety and adopting good digital security habits. While there’s no surefire way to defend yourself completely against a sophisticated attack — even very tech-savvy people get tricked sometimes — signing up for a training to learn about ways to protect yourself online can be a great place to start, if you have the chance.

And always remember to approach emails and online messages with extreme skepticism. Even when you think you know the sender, don't click links or download files without verifying their authenticity and safety first — ideally through an alternate channel of communication. That’s obviously easier said than done if you work in media, but it’s still important.

Even when emails, texts or DMs seem to come from legitimate accounts belonging to real people you know and trust, always trust your intuition first. If it feels sketchy, it might be. Use common sense, verify everything, keep your personal information private and stay safe out there!