Researchers tracked a live phishing flow that used 10 newly-registered “disposable” domains as entry points that redirected visitors to a fake AliExpress-themed site. The end site impersonated a shopping-assistant brand and pushed a browser extension, putting users at risk of credential and payment theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You click a random AliExpress deal link… and land on a slick “shopping assistant” page yelling: “Add to Browser.” Behind that page are throwaway .cyou links, all redirecting through tracking hops to a fake AliExpress site styled like Alitools, ending on a URL with a zero instead of an “o” in “shop.” The fake site claims over 500,000 users and pushes that “Add to Browser” button. Install it, and you could hand over AliExpress logins, card details, and your entire browsing history. Here’s the move: if any site pops up an AliExpress-style helper and says “Add to Browser,” ignore the button and only install extensions from our approved list or the official browser store.
German and international law enforcement disrupted the infrastructure behind “Kratos,” a phishing-as-a-service kit used at scale to steal Microsoft account logins. The kit provided convincing Microsoft-themed fake login pages designed to steal passwords and session cookies, which could help…
Attackers compromised legitimate Ukrainian websites and showed visitors a fake CAPTCHA/Cloudflare-style “verification” prompt to trick them into installing malware. The infection chain drops Lunex (aka Psychedelic Stealer), which disables security monitoring using a vulnerable AMD driver and then…
China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…
Criminals used sponsored Google search results to promote a malicious ChatGPT “Custom GPT” called “Plus 5.6.” Victims were led to a fake Cloudflare CAPTCHA page that ultimately tricked them into downloading and running a remote access trojan (RAT). This is a realistic web-based lure that can be…
A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…
Attackers are using sponsored Google ads to route people to a malicious “custom GPT” that looks like ChatGPT, even while the user is logged in on the real ChatGPT domain. The fake GPT displays a convincing “service availability” message and pushes a link to a “backup domain” that ultimately…
