This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in window, and an “AI search poisoning” campaign that tricks ChatGPT/Gemini/Google AI Overviews into recommending fraudulent phone numbers, emails, and login pages for major brands. The same theme appears in government impersonation phone scams that pressure victims into paying via wire, crypto, or prepaid cards.
This bulletin describes several social engineering schemes that share a common thread: making fraudulent content look like a routine, trusted experience. In one case, a fake Claude Max giveaway used a browser-in-the-browser technique to display a spoofed Google sign-in window. Instead of opening a real Google authentication flow, the page drew a fake browser window inside the existing tab, complete with a padlock icon and a correctly spelled Google address, to harvest login credentials.
Separately, a large-scale campaign is poisoning AI assistants and search summaries, including ChatGPT, Gemini, and Google AI Overviews, with fraudulent phone numbers, email addresses, and login pages tied to major brands. Attackers flood the web with optimized posts, PDFs, reviews, and fake support pages so that AI tools confidently surface fake contact details as if they were official.
A third pattern involves scammers impersonating law enforcement or government officials over the phone, using urgency and aggressive pressure to extract money or personal information.
Each scenario abuses a form of borrowed trust:
In all three cases, the victim is not asked to do anything unusual, just sign in, call a number, or comply with an official-sounding request.
Organizations can reduce exposure by training staff to verify sign-in prompts and contact details independently rather than trusting what appears on screen. Key habits include:
These behaviors help employees pause and verify before trusting an answer, a login window, or a phone call, regardless of how official it appears.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a campaign that floods the web with optimized posts, PDFs, reviews, and fake support pages so that AI assistants like ChatGPT, Gemini, and Google AI Overviews present fraudulent phone numbers, email addresses, and login pages as trusted answers.
It is a technique where a fake giveaway or login page draws a browser window inside the existing tab, complete with a padlock and a correctly spelled address, to trick users into entering credentials into what looks like a real sign-in window.
Scammers use urgent and aggressive tones, pressure victims to stay on the phone, and demand payment through prepaid cards, couriers, bank wires, cryptocurrency, or cash inserted into cryptocurrency kiosks.
Instead of trusting phone numbers, emails, or login pages surfaced by an AI answer, employees should navigate directly to the company's official website to confirm the information.
You search for a Claude Max upgrade, and boom, free Max giveaway, just sign in with Google. You click, and a perfect Google login pops up, padlock, correct URL and all. But it’s a browser-in-the-browser BitB fake sitting inside the page, built to steal your Google password. Same play with AI search: you ask for Delta or Chase support, and the AI confidently gives a phone number or login link that actually goes to a phishing site on some random domain. If a giveaway or AI answer pushes you to log in or call right now, don’t trust it, open the company’s official website yourself and use the contact or login links from there.
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
The FBI warned that scammers are impersonating IC3 leadership using AI-generated (deepfake) videos and spoofed IC3 websites to trick prior fraud victims into sharing more personal and financial information. In one example, victims are contacted on Facebook Messenger by someone posing as an FBI…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
