A third-party Amazon seller reportedly sent a cheap “complimentary gift” instead of a high-end graphics card, along with printed instructions designed to keep the buyer waiting until refund/return deadlines pass. The pamphlet directs the victim to email a fake “Amazon” support address to get tracking or to cancel, creating a social-engineering loop that can delay action long enough for the scammer to win.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You order a $1,400 MSI RTX 5080 on Amazon… and the box shows up with a cheap vacuum mug instead. The leaflet says the mug is a ‘complimentary gift’ and your GPU will come in seven working days because Amazon ‘collects orders and places a bulk order every Monday.’ For tracking or a refund, it tells you to email a fake Amazon support address. Here’s the scam: you keep emailing that address, they keep stalling you with fake updates, and by the time you realize the GPU is never coming, the Amazon return window has expired. If a package insert tells you to email support, ignore it. Go to Amazon’s website or app, open your Orders, and handle tracking, refunds, or cancellations only from there.
A scam campaign uses full-screen browser popups impersonating Apple Support or Amazon to claim an “unauthorized” $149.99 charge and pressure victims to call a phone number. Callers reach a live scammer posing as support who tries to gain remote access or steal payment/account details, sometimes…
This weekly threat bulletin highlights multiple real-world incidents, including a healthcare data breach claim where attackers reportedly used phone-based social engineering (vishing) to compromise identity accounts and access cloud apps. It also describes a large-scale “debt relief” email phishing…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Victims in China reported losing thousands to hundreds of thousands of dollars after scammers convinced them to move conversations onto Microsoft Teams using login credentials the scammers provided. Common setups included romance and “investment” pitches (including crypto) and official-sounding law…
A Cambodia-based scam network used ChatGPT to run multiple social-engineering schemes at once, including romance scams that pivoted into fake crypto/gold investments. The same operators also posed as online gambling reps offering fake winnings and as law enforcement demanding “fines,” using forged…
Scammers posing as HR staff at major brands are luring targets into an interview “scheduling” flow that ultimately steals corporate passwords on mobile devices. The campaign uses a browser-in-the-browser style approach (or a full-screen fake login on phones) and even blocks personal email logins to…
