CrowdStrike warns that attackers are using AI to make social engineering faster and more convincing, including AI-generated resumes and deepfake job interviews to infiltrate companies. The report also describes vishing campaigns that quickly pivot from stealing accounts to stealing data from SaaS apps, sometimes in under five minutes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a perfect resume, a flawless video interview… and the “candidate” isn’t even real. CrowdStrike reports groups like Famous Chollima using AI resumes and deepfake interviews to slip into crypto and blockchain companies, while Cordial Spider and Snarky Spider use vishing to hijack single sign-on and raid SaaS data in under five minutes. Here’s the twist: the fake candidate pressures you to skip normal checks, and the “IT support” caller says, “We’re seeing an access issue, can you read me that one-time code or approve that push so we can fix it?” That’s the handoff from deepfake to instant data theft. If anyone on a call asks you to share a one-time code or approve an unexpected login, whether it’s a candidate or “IT support”, hang up and report it to security immediately.
Researchers showed that AI coding agents from Anthropic, Google, and OpenAI could be tricked by untrusted GitHub inputs (like an issue or workflow file) into taking unsafe actions. In the demos, a single malicious issue or writable workflow file could lead to remote code execution, stolen…
Researchers showed that a single public GitHub issue (from someone with no repo access) could steer popular AI coding agents into running dangerous commands, exposing tokens, and changing repositories. The risk comes from AI agents reading untrusted issue/PR text while also having access to…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Researchers simulated “pig butchering” romance-style scams and found an AI chatbot built trust more effectively than a human scammer over a week of texting. In the test, victims were significantly more likely to comply with the AI’s request to install an app, showing how AI could automate the long…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
