U.S. and international agencies warned that China-linked actors, enabled by a China-based company (Integrity Technology Group), are breaking into organizations including U.S. critical infrastructure. A key technique described is altering legitimate webpages to show fake login prompts that steal usernames and passwords, followed by offering a “software download” that is actually malware.
U.S. and international agencies described a multi-stage technique used by China-linked threat actors, enabled by a China-based company, Integrity Technology Group, against organizations including U.S. critical infrastructure. The actors used cross-site scripting to modify legitimate webpages so that visitors saw a fake login prompt designed to harvest usernames and passwords. Once a victim entered credentials, the page offered a software download that actually contained malware disguised as legitimate Windows software.
This approach is notable because it does not rely on a separate phishing email to lure victims to a fake site. Instead, it compromises a webpage that targets already trust, inserting the fake login step directly into a normal browsing session.
The campaign extended past the initial credential theft. Agencies found that the actors also targeted Microsoft Office 365 cloud accounts and Exchange email servers, using password spraying and password guessing across multiple access points. For persistence and to hide command-and-control activity, they used legitimate VPN software, often renaming installers to resemble Windows executables. Stolen email data was staged for exfiltration, including through scripts that accessed Exchange Web Services.
Several factors made this technique effective:
Defenders and employees should treat the following as warning signs:
Organizations can reduce exposure to this type of attack by combining technical controls with user awareness. Key steps include implementing identity, credential, and access management policies with multifactor authentication for all services where possible, particularly webmail, VPNs, and accounts that access critical systems. Employees across all roles, including IT/Helpdesk, SOC, and operations staff, should be trained to distrust unexpected login requests and to avoid downloading software offered by a webpage, verifying updates only through trusted company channels instead.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Threat actors used cross-site scripting to modify legitimate webpages so visitors saw a fake login prompt that harvested usernames and passwords, then offered a software download disguised as legitimate Windows software.
After a user entered credentials, the page offered a download that contained malware disguised as legitimate Windows software.
Yes, the actors also targeted Microsoft Office 365 cloud accounts and Exchange email servers using password spraying and password guessing across multiple access points.
Agencies recommend multifactor authentication for webmail, VPNs and accounts that access critical systems, along with suspicion of unexpected login prompts and software downloads offered by webpages.
You’re on a site you use all the time, and suddenly a box pops up: “Login required to continue.” You trust it… right? U.S. agencies say a China-based firm, Integrity Technology Group, helped plant these fake logins using cross-site scripting. You type your Office 365 password, hit submit… and then it offers a “Windows software” download that’s actually malware. Here’s the trick: the page itself was hacked. It never used to ask you to re-login, and now, right after you do, it pushes an installer that doesn’t come from IT. That combo is your red flag. If a familiar site suddenly asks you to log in and then download “Windows software,” stop. Close the page and report it to IT, don’t enter your password, don’t run the file.
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
A financially motivated group called Breeze Comet targeted Brazilian financial and retail organizations by impersonating IT support and convincing staff to install remote-access tools. After gaining access, the attackers moved into internal payment systems (like Pix/STR/Boleto) and executed…
Researchers linked an Iran-aligned campaign to recruitment-themed social engineering that tricked a targeted Iraqi software engineer into downloading a fake "Dubai Airports" careers portal and then opening a trojanized Visual Studio coding test. The lure abused normal developer workflows so malware…
