A former AT&T retail employee helped a SIM-swap crew hijack customers’ phone numbers, letting the criminals intercept SMS two-factor codes and reset online banking passwords. The gang then attempted (and in one case succeeded) to wire large sums from victims’ bank accounts, often to accounts in Portugal.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An AT&T store worker was paid up to two grand a pop to quietly move customers’ phone numbers onto SIM cards for a criminal crew. Once your number was hijacked, they’d trigger bank password resets. All the SMS two-factor codes and reset links went to the crew, and they tried wiring about two hundred forty-seven thousand dollars per victim, one account lost ninety-nine thousand five hundred twenty-eight dollars and thirty-three cents. Here’s the scary part: this wasn’t fancy hacking. It was insider access plus the weakness of SMS codes. One insider ran this from 2018 to 2019, getting paid per SIM swap, and investigators later found victims’ Social Security numbers sitting at his home. Your move: for any important account, drop SMS codes. Switch to an authenticator app or hardware key today, and treat any sudden loss of mobile service as an emergency.
Attackers used fake Microsoft sign-in pages to capture already-authenticated Microsoft 365 sessions, then replayed those sessions to enter business accounts without passwords or new MFA prompts. The campaign affected 79 organizations and expanded access by registering rogue devices, changing MFA…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
UK authorities said two Scattered Spider members accessed Transport for London (TfL) by buying partial employee credentials and then tricking TfL’s helpdesk into resetting an employee password and 2FA. The attackers kept access for several days, escalated privileges, and ultimately exposed customer…
The MR ROBOT malware service rents customized fake Android banking apps to criminals targeting Indian bank customers. Victims are lured through fake Play Store-style pages and links in messaging apps, then tricked into installing apps that can steal banking details, intercept one-time passwords,…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…
