What happened
On 19 March 2016 Hillary Clinton campaign chairman John Podesta received an email styled as a Google security alert warning that someone had his password and urging him to change it. The Bitly-shortened link led to a credential harvesting page controlled by Russian military intelligence. More than 50,000 of Podesta's emails were later published by WikiLeaks; similar spear phishing was used against DNC staff.
How the deception worked
The message imitated Google's 'Someone has your password' notification and carried a Bitly link masking an attacker-controlled domain that rendered a pixel-perfect Google account login page. A campaign IT aide replied that the mail was legitimate, later saying he had meant to write 'illegitimate,' and the link was clicked and the password entered. With mailbox access the operators archived the account's contents. The same infrastructure was used across hundreds of targets; because Bitly statistics were public, researchers were later able to reconstruct the target list and confirm the operator's identity.
AI involvement · No AI reported
No AI element reported.
The control that would have caught it· our reading, not a claim from the sources
Hardware security keys on campaign and executive Google accounts make a harvested password worthless, and a defined out-of-band process for verifying security alerts avoids relying on a hurried email reply.
Sources (3)
- Is this the email that hacked John Podesta's account?CNN·cnn.comOpen ↗
- How hackers broke into John Podesta, DNC Gmail accountsSophos Naked Security·news.sophos.comOpen ↗
- How John Podesta's Emails Were Hacked And How To Prevent It From Happening To YouForbes·forbes.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.