Cisco Talos reports finding real AI prompt logs showing threat actors using AI tools to build criminal operations, including a bulk-email system that sends “privacy policy/account update” messages just to see which addresses are active. The operation used multiple subject-line variants and a tracking pixel to measure delivery and opens, building a higher-value list for later campaigns.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Privacy Policy Update – Action required for your Tubely account.” Never heard of Tubely? That’s the point. Cisco Talos found AI prompt logs where tools were used to build bulk “Tubely account update” emails, rotating subjects like “{name}, your Tubely account is being updated” just to see who opens. Each email hides a one-pixel image that phones home when you open it, confirming your address is real and logging your IP, timing, and device. It’s phishing-adjacent list building for future attacks. If you get a “policy” or “account update” email for a service you don’t use, don’t open it, delete it. Don’t let AI-built test emails mark you as a future target.
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
The article describes real phishing activity seen across multiple enterprise customers, where attackers used well-known AI brands as lures because employees now expect routine AI-related emails. It includes concrete subject lines, a suspicious impersonation domain, and an example of abusing…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
