Researchers tracked a live phishing flow that used 10 newly-registered “disposable” domains as entry points that redirected visitors to a fake AliExpress-themed site. The end site impersonated a shopping-assistant brand and pushed a browser extension, putting users at risk of credential and payment theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You click a random AliExpress deal link… and land on a slick “shopping assistant” page yelling: “Add to Browser.” Behind that page are throwaway .cyou links, all redirecting through tracking hops to a fake AliExpress site styled like Alitools, ending on a URL with a zero instead of an “o” in “shop.” The fake site claims over 500,000 users and pushes that “Add to Browser” button. Install it, and you could hand over AliExpress logins, card details, and your entire browsing history. Here’s the move: if any site pops up an AliExpress-style helper and says “Add to Browser,” ignore the button and only install extensions from our approved list or the official browser store.
German and international law enforcement disrupted the infrastructure behind “Kratos,” a phishing-as-a-service kit used at scale to steal Microsoft account logins. The kit provided convincing Microsoft-themed fake login pages designed to steal passwords and session cookies, which could help…
A commonly used documentation placeholder domain, third-party.com, was registered by an unknown party and is now serving a ClickFix social-engineering lure to Windows users. The page pretends to run a Cloudflare security check, silently poisons the clipboard, and tells victims to paste and run a…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Microsoft says it disrupted the “EvilTokens” phishing-as-a-service platform, which it links to compromises of over 12,000 inboxes across more than 10,000 organizations. The service used AI to tailor phishing emails to a victim’s role and to analyze compromised inboxes to identify trusted…
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations…
