A former AT&T retail employee helped a SIM-swap crew hijack customers’ phone numbers, letting the criminals intercept SMS two-factor codes and reset online banking passwords. The gang then attempted (and in one case succeeded) to wire large sums from victims’ bank accounts, often to accounts in Portugal.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An AT&T store worker was paid up to two grand a pop to quietly move customers’ phone numbers onto SIM cards for a criminal crew. Once your number was hijacked, they’d trigger bank password resets. All the SMS two-factor codes and reset links went to the crew, and they tried wiring about two hundred forty-seven thousand dollars per victim, one account lost ninety-nine thousand five hundred twenty-eight dollars and thirty-three cents. Here’s the scary part: this wasn’t fancy hacking. It was insider access plus the weakness of SMS codes. One insider ran this from 2018 to 2019, getting paid per SIM swap, and investigators later found victims’ Social Security numbers sitting at his home. Your move: for any important account, drop SMS codes. Switch to an authenticator app or hardware key today, and treat any sudden loss of mobile service as an emergency.
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
UK authorities said two Scattered Spider members accessed Transport for London (TfL) by buying partial employee credentials and then tricking TfL’s helpdesk into resetting an employee password and 2FA. The attackers kept access for several days, escalated privileges, and ultimately exposed customer…
A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
Microsoft warns of an active social engineering campaign where attackers pose as an IT help desk and pressure employees to “update” passkeys/MFA/SSO. Victims are sent to fake Microsoft sign-in pages or tricked into approving access via device-code login, enabling attackers to add their own MFA…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
