Microsoft tracked a real macOS ClickFix campaign using 250+ domains that fingerprint visitors to hide malicious pages from security scanners. Selected Mac users are shown a fake “Download for macOS” lure and prompted to copy/paste an obfuscated command into Terminal, which then pulls down scripts and installs an infostealer (AMOS) to steal credentials and sensitive data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On your Mac, you click a link and land on a slick GitHub-style page: big blue button, “Download for macOS.” Looks totally legit. Behind the scenes, ClickFix is fingerprinting you. If you look like a real Mac user, it shows a forged “Verified Publisher” badge and tells you: copy this weird command into Terminal to continue. Here’s the trap: that one pasted command quietly pulls down more scripts and launches Atomic Stealer, ripping passwords, browser data, even crypto wallets off your Mac. Aha rule: any website that tells you to paste a command into Terminal? Stop. Close the tab. Then report it to security and say you hit a fake macOS download asking for Terminal.
A real multi-stage phishing campaign abused trusted cloud platforms (notably Cloudflare Workers) to make fake login flows look legitimate and to bypass MFA. The attack chained a phishing email, a fake CAPTCHA page on a compromised site, and a browser “pop-up” spoof that captured both credentials…
A threat landscape report describes how criminals now buy or rent phishing, fraud, malware, and hidden infrastructure “as a service,” making scams faster to launch and harder to stop. The article highlights practical, repeatable social-engineering workflows such as fake CAPTCHA pages that trick…
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Researchers and a Windows app developer uncovered a campaign using lookalike “official” software download websites that rank highly in Google results. The sites initially serve legitimate downloads to build trust, then quietly swap the download links to malware that can steal credentials and…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
