Cisco Talos reports finding real AI prompt logs showing threat actors using AI tools to build criminal operations, including a bulk-email system that sends “privacy policy/account update” messages just to see which addresses are active. The operation used multiple subject-line variants and a tracking pixel to measure delivery and opens, building a higher-value list for later campaigns.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Privacy Policy Update – Action required for your Tubely account.” Never heard of Tubely? That’s the point. Cisco Talos found AI prompt logs where tools were used to build bulk “Tubely account update” emails, rotating subjects like “{name}, your Tubely account is being updated” just to see who opens. Each email hides a one-pixel image that phones home when you open it, confirming your address is real and logging your IP, timing, and device. It’s phishing-adjacent list building for future attacks. If you get a “policy” or “account update” email for a service you don’t use, don’t open it, delete it. Don’t let AI-built test emails mark you as a future target.
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
A Russia-linked threat group compromised hotel WiFi captive portals to redirect guests to fake “verification” pages. Victims were pushed toward either copying commands into a terminal to install malware or entering Microsoft credentials on spoofed login pages that added an attacker-controlled…
Attackers are taking over hotel and conference Wi‑Fi gateways and changing DNS settings so travelers are silently redirected to fake Microsoft 365 sign-in pages. Victims are then tricked into completing a device-code login that grants attackers a legitimate session token, often bypassing MFA. This…
