Woogle: The fake merger that proves we need zero trust

A few weeks ago, Google dropped a bombshell: a $32 billion move to acquire Wiz.

That’s billion with a “B”—the kind of money where you could buy a 2025 Ford Raptor R in every color, then still have enough left over to buy Reddit and give it a long-overdue personality transplant.

As I was recording my PEBCAK podcast, I had a thought: what if, instead of acquiring Wiz, Google just merged with them in a glorious branding mashup? I started tossing around names like Wizgle, G-Wiz, and my personal favorite—Woogle.

Then, like any reasonable adult with an internet connection and a sense of mischief, I thought to myself: What would happen if I posted a fake announcement on LinkedIn saying Google and Wiz had merged?

So I did.

Using the dark arts of ChatGPT and a suspiciously professional-looking fake logo, I fired off a spoof announcement at 5:00 a.m. on a Monday: you know, peak “executive reads LinkedIn on the toilet” hours.
 

And then I watched.

The Experiment

I embedded a harmless (but external) link just to see what kind of traction it would get. It wasn’t phishing. It wasn’t malware. It wasn’t even a rickroll. Just a decoy. A social engineering honeypot.

Within three days, the link was clicked 1,813 times. By week four, over 2,500.
 

Imagine for a second that this wasn’t some playful hoax. Imagine that link had been laced with malware, cross-site scripting, or an actual credential harvester.

This wasn’t a test environment. This was LinkedIn, a platform that professionals trust implicitly. But here’s the problem: trust is not a control.

Lessons from Woogle

• Even the best of us click dumb links. Titles like “BREAKING: Google merges with Wiz in $32B ‘Woogle’ Deal” are catnip.
• User training is still your first and last line of defense. You can’t patch human curiosity, but you can make people pause before clicking.
• TLS inspection is non-negotiable. Just because something is encrypted doesn’t mean it’s safe—it might just be a very secure Trojan horse.
• Zero Trust isn’t a vibe—it’s the equation for not getting owned. One user. One click. That’s all it takes. 1800+ fell for it, and this wasn’t even real. Trust nothing, inspect everything.

So what started as a joke turned into a proof point: if your security strategy hinges on "nobody here would fall for that," then congratulations—you’re already compromised. The Woogle isn’t just a mythical merger. It’s a mirror.