A former AT&T retail employee helped a SIM-swap crew hijack customers’ phone numbers, letting the criminals intercept SMS two-factor codes and reset online banking passwords. The gang then attempted (and in one case succeeded) to wire large sums from victims’ bank accounts, often to accounts in Portugal.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An AT&T store worker was paid up to two grand a pop to quietly move customers’ phone numbers onto SIM cards for a criminal crew. Once your number was hijacked, they’d trigger bank password resets. All the SMS two-factor codes and reset links went to the crew, and they tried wiring about two hundred forty-seven thousand dollars per victim, one account lost ninety-nine thousand five hundred twenty-eight dollars and thirty-three cents. Here’s the scary part: this wasn’t fancy hacking. It was insider access plus the weakness of SMS codes. One insider ran this from 2018 to 2019, getting paid per SIM swap, and investigators later found victims’ Social Security numbers sitting at his home. Your move: for any important account, drop SMS codes. Switch to an authenticator app or hardware key today, and treat any sudden loss of mobile service as an emergency.
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
UK authorities said two Scattered Spider members accessed Transport for London (TfL) by buying partial employee credentials and then tricking TfL’s helpdesk into resetting an employee password and 2FA. The attackers kept access for several days, escalated privileges, and ultimately exposed customer…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations…
