Court records allege that CBP officers used a false claim about searching for child sexual abuse material to pressure activist Samuel Tunick during an airport device search. The records indicate the real stated purpose in an internal alert was an investigation into suspected terrorist activity, while officers sought access to his phone and passcodes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
At airport secondary inspection, an alarming accusation can become pressure to unlock your phone. Court filings say CBP officers asked activist Samuel Tunick that question. But an HSI alert described suspected terrorist activity and directed officers to retain his electronics and collect passcodes. That's the pretexting: the accusation didn't match the alert. Tunick gave a code that wiped his GrapheneOS phone; he now faces a charge over the alleged deletion. If officials request your work device or passcode, follow their lawful instructions, and contact your company's travel-security team as soon as permitted.
Leaked chat logs linked to the Silent Ransom Group describe efforts to pressure U.S. law firms through extortion and, unusually, by sending in-person “agents” to physically enter offices and copy data. The FBI previously warned that people tied to the group were posing as IT staff to gain access,…
A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic…
INTERPOL’s Operation Serengeti III arrested 1,462 suspects across 21 countries targeting fraud, phishing, business email compromise, ransomware, and digital extortion. In Uganda, investigators found scam call centres using prepared scripts and fake trading platforms to persuade people, including…
This weekly roundup describes several real social-engineering campaigns, including fake government-payment posts that compromised thousands of Bluesky accounts and mobile scams disguised as community activities. It also documents AI-generated bank-helpdesk calls that persuaded victims to install an…
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
This article describes ClickFix attacks in which fraudulent or compromised websites display fake technical warnings and persuade visitors to copy and run harmful commands. The scam may claim a browser update, failed security check, or urgent technical repair is needed, then directs the user to use…
