Microsoft Threat Intelligence reports real campaigns where attackers impersonate popular AI tools (like ChatGPT, Copilot, DeepSeek, and Claude) to trick people into clicking links, installing fake software, or entering payment and login details. One campaign sent up to 100,000 emails in a day to steal ChatGPT Plus payment data, while another used a document-sharing lure to push a legitimate Microsoft “device code” login flow for business email compromise.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
That email saying, “Please update your ChatGPT Plus payment information”? That might not be ChatGPT at all. Microsoft found a ChatGPT-themed phishing wave blasting up to 100,000 emails a day, plus lookalikes for Copilot, DeepSeek, even Claude, pushing fake payment pages, bogus installers, and AI plugins hiding malware. One case was sneakier: a fake document share triggered a real Microsoft device code sign-in. The login box was legit, but the reason you saw it wasn’t. That’s the trap: real sign-in flow, fake story. So when you get any AI-branded email about billing, plugins, or sign-ins, don’t click the link, open the service yourself in a new tab and check from there.
A threat landscape report describes how criminals now buy or rent phishing, fraud, malware, and hidden infrastructure “as a service,” making scams faster to launch and harder to stop. The article highlights practical, repeatable social-engineering workflows such as fake CAPTCHA pages that trick…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
