This report describes real-world social engineering where victims are tricked into copying and pasting commands that install malware on macOS and Windows. It also highlights device code phishing activity targeting Microsoft Entra ID/Microsoft 365 tokens, enabling attackers to access accounts and data without needing passwords in some cases.
This reporting describes two related social engineering patterns. The first involves copy-paste lures that instruct victims to run a command in Terminal (macOS) or Command Prompt (Windows) to fix a problem or complete a setup step. On macOS, these commands used curl and osascript to fetch and execute Phexia, which then established persistence through LaunchAgents. On Windows, similar lures tricked users into running commands that downloaded and silently installed an MSI file containing EtherRAT, using flags that hide the installation from the user.
The second pattern involves device code phishing using GraphSpy, an open-source tool that abuses the legitimate Microsoft device code sign-in flow to capture Entra ID and Microsoft 365 authentication tokens. This can give attackers account access without needing the victim's password.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a social engineering technique where victims are told to copy and paste a command into Terminal or Command Prompt to fix an issue or complete setup, but the command actually downloads and installs malware.
Phexia targets macOS through curl and osascript commands leading to persistence via LaunchAgents, while EtherRAT targets Windows through commands that silently download and install a malicious MSI file.
Device code phishing uses a legitimate Microsoft sign-in flow to trick users into entering a code that lets attackers capture Entra ID or Microsoft 365 authentication tokens, sometimes bypassing the need for a password.
Recommended steps include revoking the affected user's refresh tokens and active sessions, resetting account credentials, and requiring re-authentication.
If an email ever says, “Just copy and paste this command into Terminal or Command Prompt,” stop right there. We’re seeing real campaigns where macOS Phexia and Windows EtherRAT get installed just by you pasting commands like curl gl1nto.spiintforge[.]ru or an msiexec line from reeemso.forwardbox[.]co[.]uk. Once that runs, malware can sit in LaunchAgents or silently install an MSI, then use tools like GraphSpy and device code phishing to grab your Microsoft 365 tokens, no password needed. Your move: any email or chat that tells you to copy and paste a command into Terminal or Command Prompt, pause, don’t run it, and send it to IT using our normal helpdesk channel.
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
