Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run commands/install tools that give attackers access. The techniques highlighted include fake software installs/updates, Browser-in-the-Browser (BitB) login fakes, ClickFix “verification” pages, and Microsoft device-code phishing.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Your browser can lie to you now. Not by bugs, by perfect fakes of updates, CAPTCHAs, and login pop-ups. Example one: a PDF link says, “This document can’t be viewed, update the viewer.” The page spoofs Adobe Reader and walks you through an install, really it’s dropping a remote access tool. Example two: a CAPTCHA says, “Verification required,” then tells you to copy PowerShell commands to fix your browser. Here’s the twist: some scams don’t fake the page at all. They use real Microsoft device sign-in, but with a code they give you. Others use “browser-in-the-browser” pop-ups that look like normal single sign-on windows, floating inside the webpage to steal your password. Aha rule: if a webpage tells you to install software or run PowerShell, Terminal, or Run commands, stop and report it to IT, do not follow the steps.
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
Attackers sent emails that looked like Microsoft Teams/HR notifications and pushed users through Microsoft’s real sign-in and OAuth consent screens. When victims approved the requested permissions, the attackers obtained an authorization token and could access Microsoft 365 data like Outlook,…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
