A real multi-stage phishing campaign abused trusted cloud platforms (notably Cloudflare Workers) to make fake login flows look legitimate and to bypass MFA. The attack chained a phishing email, a fake CAPTCHA page on a compromised site, and a browser “pop-up” spoof that captured both credentials and MFA-backed session tokens, then redirected victims to a generic error to reduce suspicion.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from a coworker: “Please review these documents.” You click, and a CAPTCHA page pops up asking for your email. You type your email, hit Continue, and your browser quietly bounces through a compromised site to a Cloudflare Workers link, something like example.workers.dev with your email stuck after a # in the URL. Then a browser-in-the-browser fake Microsoft pop-up appears. It shows a perfect Microsoft login page and a trusted URL in its own little address bar, but it’s just a BitB overlay stealing your password, MFA, and session. If a CAPTCHA asks for your email or a login suddenly appears in a pop-up, stop. Close it, and instead open Microsoft by typing the address into a fresh tab yourself.
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Attackers are taking over hotel and conference Wi‑Fi gateways and changing DNS settings so travelers are silently redirected to fake Microsoft 365 sign-in pages. Victims are then tricked into completing a device-code login that grants attackers a legitimate session token, often bypassing MFA. This…
Researchers observed insurance-themed phishing that doesn’t just steal passwords, it hijacks accounts in real time while the victim is actively logging in. The attack often starts with sponsored Google ads that lead to convincing fake insurance portals, which immediately prompt victims for one-time…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
