Hacker News Reader

Or "A16z" at least...

I had to quickly check that my Albert Heijn bonus account hadn't been robbed!

The title sounded like a crypto thing, so I assumed it was some web3 term like Auction House

I tried that. Too long. Not essential anyway, IMO, the attack is much more interesting than the victim's employer's name.

The only reason I clicked the link was to know what AH meant. Phishing for crypto assets is nothing new, I wouldn’t have clicked it for that.

If I understand the attack correctly:

Twitter followers were migrated, but anyone "following" using something like a crontab that retrieves a link based on the old Twitter name might be fooled.

Even that is apparently not to fringe to work for phishing.

They could also make initial contact with victims using the scam account (new account that took the old user name).