Elastic researchers documented real intrusions in which attackers used deceptive verification pages, fake invitations, and phishing sign-in workflows to gain access. In confirmed infostealer cases, attackers used stolen credentials an average of eight minutes after infection, and one healthcare victim ran a malicious installer only seconds after following a lure.
Researchers at Elastic documented real intrusions built around three recurring tactics: deceptive verification pages, fake invitations, and phishing sign-in workflows. The most common entry point was a ClickFix-style page that tells the user to copy and run a command to complete a verification or troubleshooting step. In one healthcare case, a malicious installer was delivered and executed through DLL sideloading about 16 seconds after the user followed the lure.
A second pattern involved device-code phishing, where a target was persuaded to enter a code on Microsoft's legitimate sign-in page. Approving that code granted the attacker a session they had initiated, and follow-on activity included registering a virtual device to maintain access. A third pattern used fake digital invitations that led to hidden installations of remote monitoring and management software, including ScreenConnect, which then connected to an attacker-controlled server and ran as a Windows service.
These techniques worked because they shift the harmful action onto the user rather than relying on a malicious file an email filter might catch. When a person copies and runs a command themselves, or manually enters a code on a real sign-in page, the activity can look like normal user behavior rather than an attack. Researchers also found that once credentials were stolen, attackers moved quickly. Across 27 confirmed infostealer cases, stolen credentials were used an average of eight minutes after infection, leaving minimal time for detection before account access occurred.
Organizations and individuals can reduce exposure to these patterns through a few consistent habits. Never copy and run commands from a website, even when it is presented as a verification or troubleshooting step, since this approach is designed to bypass defenses that scan email attachments. Treat unexpected device-code requests as suspicious and only approve sign-ins that were personally initiated. Avoid installing software from unexpected invitations or archives, and confirm such requests through a known business contact or approved support channel. Finally, because stolen credentials can be used within minutes, reporting unusual account activity quickly matters as much as preventing the initial compromise.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a fake website prompt that tells a user to copy and run a command, often disguised as a verification or troubleshooting step. These pages were the most common entry point, appearing in 12 confirmed cases.
Across 27 confirmed infostealer cases, attackers logged in with stolen credentials an average of eight minutes after infection, which leaves little time to respond.
It is a technique where a victim is persuaded to enter an attacker-supplied code on a legitimate sign-in page, such as Microsoft's, which approves a session the attacker initiated rather than the user.
Researchers confirmed 23 cases of abuse involving remote monitoring and management software, with ScreenConnect named most often, often installed through fake invitations or phishing pages.
Eight minutes. That’s how fast stolen logins were used, on average. The common entry point? ClickFix. A page says, ‘Complete verification by copying and running this command.’ One healthcare victim ran a malicious installer just 16 seconds after following the lure. That’s the tell: real browser verification doesn’t need you to run a command on your computer. And an unexpected Microsoft device code can approve someone else’s session, even with MFA. If a page asks you to run a command or enter a code you didn’t request, stop and report it to security.
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
Researchers demonstrated that malicious web pages and local previews can abuse embedded browsers in popular AI coding assistants. The attacks can hide instructions from users, spoof trusted login addresses, or access sensitive files, creating realistic risks for developers who open untrusted links…
A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an…
