Underground cybercrime forums sell reputation manipulation as an on-demand service: operators offer to post five-star reviews across platforms such as Google, Trustpilot, Yelp, and app stores, or to remove negative feedback. One seller claims reviews are posted manually and guaranteed to remain online, while another says a secret method helped it publish more than 10,000 fake reviews. “Manual” does not mean reviewers are actual customers. Removing a review typically costs $100-$200, but one seller advertised Airbnb review removal for about $1,100. Such services may target legitimate complaints as well as fabricated ones, obscuring recurring problems with products, refunds, or customer service.
Researchers also found forum users discussing AI-generated reviews designed to imitate the qualities of experience, expertise, authority, and trustworthiness, and to improve search visibility. Sellers can use residential and mobile proxies - traffic routed through home internet or cellular connections - to make campaigns appear to come from ordinary consumers rather than data centers. These techniques make fake feedback harder to identify and potentially easier to produce at scale. To judge reviews, shoppers should look beyond overall star ratings: read recent and middling reviews, watch for repeated wording or sudden bursts of praise, and check seller contact details and return policies. Suspicious patterns are warning signs, not proof that a review is fake.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Attackers stole enterprise cloud and AI credentials to run up fraudulent model-usage charges, with some companies facing bills near $1 million. Criminal groups resell stolen access through illicit gateways, prompting Google to urge stronger credential security and monitoring. (cloud.google.com)
Milner Mayor Craig Timmons secretly GPS-tracked Police Chief Bunn over timesheet concerns, bypassing city council approval. The chief, five officers, and city manager resigned, leaving the Georgia town without full-time police officers. (gadgetreview.com)
A Google Android partner allegedly infected 1.3 million set-top boxes with malware and turned them into a botnet. Google says the manufacturer intentionally hijacked the devices. (theverge.com)
WorkOS detected unauthorized access to an internal API, exposing data from Salesforce and Snowflake, including customer contact details, business information, and support tickets. WorkOS says it has found no evidence that customer application data or production services were accessed or affected. (news.ycombinator.com)
![I discovered a sound that leaks your exact location (and it's everywhere) [video]](https://hntoday.pixelshot.io/screenshots/20261103/3cae09e1cadc4410_tn.jpeg)
A sound signal found in everyday environments can reveal someone’s exact location. The discovery raises concerns about location privacy. (youtube.com)
The New York Times and several other publishers sued Brave, alleging it scraped and distributed copyrighted content to AI companies without permission. The lawsuits also challenge Brave’s paywall-bypassing feature and ad blocking, and seek damages and an injunction. (techcrunch.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.