A real multi-stage phishing campaign abused trusted cloud platforms (notably Cloudflare Workers) to make fake login flows look legitimate and to bypass MFA. The attack chained a phishing email, a fake CAPTCHA page on a compromised site, and a browser “pop-up” spoof that captured both credentials and MFA-backed session tokens, then redirected victims to a generic error to reduce suspicion.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from a coworker: “Please review these documents.” You click, and a CAPTCHA page pops up asking for your email. You type your email, hit Continue, and your browser quietly bounces through a compromised site to a Cloudflare Workers link, something like example.workers.dev with your email stuck after a # in the URL. Then a browser-in-the-browser fake Microsoft pop-up appears. It shows a perfect Microsoft login page and a trusted URL in its own little address bar, but it’s just a BitB overlay stealing your password, MFA, and session. If a CAPTCHA asks for your email or a login suddenly appears in a pop-up, stop. Close it, and instead open Microsoft by typing the address into a fresh tab yourself.
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Attackers are taking over hotel and conference Wi‑Fi gateways and changing DNS settings so travelers are silently redirected to fake Microsoft 365 sign-in pages. Victims are then tricked into completing a device-code login that grants attackers a legitimate session token, often bypassing MFA. This…
Researchers observed insurance-themed phishing that doesn’t just steal passwords, it hijacks accounts in real time while the victim is actively logging in. The attack often starts with sponsored Google ads that lead to convincing fake insurance portals, which immediately prompt victims for one-time…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Microsoft reported a campaign where attackers abused hotel Wi‑Fi captive portals to manipulate DNS/HTTP traffic and redirect people to attacker-controlled phishing pages. Victims were tricked into installing malware disguised as browser/operating system updates, and some pages redirected users into…
