The recap describes a real Microsoft 365 phishing campaign using DocuSign-themed emails that push victims through multiple redirects to a fake sign-in page. The goal is to steal session tokens (so attackers can log in even if a password changes) and also perform “device code” style sign-in abuse. The article also notes a newer trick where QR codes made of plain text can still appear even when email images are blocked.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “DocuSign: Please review and sign.” Looks normal, right? This one isn’t. You click the link or scan the QR, and your browser bounces: first to Monday.com, then a random Joomla site, then finally a Microsoft 365 sign‑in that looks real. This is a Microsoft 365 adversary‑in‑the‑middle kit called Knight Office. When you sign in here, it doesn’t just steal your password, it steals your session token so they can log in as you even after you change it. If a DocuSign email makes you sign in to Microsoft and you see weird redirects, stop. Close the tab and open DocuSign or M365 from your own bookmark instead.
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
A Russia-linked threat group compromised hotel WiFi captive portals to redirect guests to fake “verification” pages. Victims were pushed toward either copying commands into a terminal to install malware or entering Microsoft credentials on spoofed login pages that added an attacker-controlled…
