Attackers compromised Arara Message, a Japanese email delivery platform, potentially exposing about 77 million email addresses across roughly 380 client companies. They then used the trusted service to send up to 7.13 million suspicious emails that impersonated credit card companies and asked recipients to confirm account activity or billing statements.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A card alert in your inbox? Check who actually sent it. After Arara Message was breached, its email service sent up to 7.13 million messages posing as credit card companies. The pitch: ‘Please confirm your account usage and billing statement.’ Here’s the catch: the email came through a real delivery service, but news@arara.com isn’t your card company. A familiar-looking message doesn’t prove the request is real. Got an unexpected billing alert? Open your card company’s website yourself to check your account.
MS-ISAC tracked attackers who used a phished K-12 staff account to send phishing messages to that employee’s contacts, including staff at other school districts. Because the messages came from legitimate, authenticated accounts, they could bypass normal email filters and help attackers move from…
Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into…
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
The FBI warns that scammers are impersonating political candidates and campaigns to solicit donations and steal personal information ahead of the midterms. Attackers use candidates’ names, logos, and AI-generated voices or messages, while weak email authentication can allow fraudulent messages to…
ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer…
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
