The fake email that started it all: 'Action required, payroll'
A single click on a Tuesday is now the working theory of investigators.
The entire Wicked Bank breach may trace back to a single email with the subject line "Action required: payroll," opened on Tuesday 3 June.
Investigators at High Tech Inc believe the attachment harvested the credentials later used to authorise the transfers. "One click on a Tuesday," one source said. "That's the whole story."