Cofense reports ongoing mass email campaigns that impersonate trusted brands (and even government agencies) to trick recipients into calling a phone number for “remediation.” The lures typically claim an unauthorized purchase or a password reset and use urgency to pressure victims into acting quickly, shifting the interaction to a phone call where scammers have more control.
Cofense reports mass email campaigns hitting client inboxes daily that impersonate well-known brands, and in some cases government agencies, to trick recipients into calling a phone number for remediation. The lures typically claim a password reset is needed or that an unauthorized purchase has occurred, creating a sense of loss or account compromise that pressures the recipient to act fast.
Rather than asking the victim to click a link or enter credentials directly in the email, the goal is to move the conversation off email and onto a phone call. Once on the phone, scammers have far more control over the interaction and can manipulate the victim through live conversation rather than a static message.
Several factors make these campaigns effective:
Employees should treat unsolicited purchase or password reset alerts as high-risk until verified independently, using a known official number or website rather than any contact information provided in the email itself. Finance and AP staff should be especially cautious with purchase-related lures, and IT or helpdesk teams should expect to be an escalation point when employees receive these messages. Building awareness around the specific pattern of these attacks, brand impersonation, urgency, and a push toward a phone call, gives employees a concrete way to recognize the scam even as the impersonated brand or exact wording changes from campaign to campaign.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a mass email campaign that impersonates a trusted brand or agency, claims an unauthorized purchase or password reset, and pressures the recipient to call a phone number for remediation instead of replying by email.
Moving the interaction to a phone call gives scammers more control over the conversation and lets them manipulate the victim in real time, away from any email-based security controls.
Some campaigns include links hosted on legitimate-seeming platforms like GitHub that redirect to a fake invoice page, adding a layer of credibility to the fraudulent claim.
All employees are targeted, but finance and accounts payable staff are more likely to react to purchase-related lures, while helpdesk and IT teams are likely escalation targets.
You get an email from “Geek Squad” or “PayPal” screaming: CALL IMMEDIATELY about an unauthorized charge. This is a phonescam: mass emails pretending to be Microsoft, Amazon, or Norton, all trying to push you off email and onto a phone call where scammers take over. One Geek Squad scam even uses a real-looking GitHub link to a 'completed purchase' invoice, but it quietly redirects to a fake invoice and the same pressure to call their number. If an email says there’s an unauthorized purchase or password reset and tells you to call a number, don’t call it, go to the brand’s website or app yourself and check from there.
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
Cofense observed a real phishing campaign impersonating Google Ads Sync Accounts (MMC) with a fake “maintenance/system upgrade” notice. The email pressures recipients to click “Complete Sync Account,” sending them through lookalike sites and a fake Google sign-in pop-up that captures credentials.…
