A scam campaign uses full-screen browser popups impersonating Apple Support or Amazon to claim an “unauthorized” $149.99 charge and pressure victims to call a phone number. Callers reach a live scammer posing as support who tries to gain remote access or steal payment/account details, sometimes pushing payment via gift cards or wire transfer.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re browsing, and suddenly your screen locks up: “Apple ID charged $149.99 – call immediately to stop this payment.” Sometimes it’s Apple, sometimes Amazon, but the script’s identical: a $149.99 “Pre-Authorization,” a big warning icon, and the same phone number as your only option. The popup wants one thing: for you to call. On that line, a fake “support” rep pushes remote access to your computer or payment by gift cards or wire transfer. If you see a $149.99 charge popup, don’t call the number, close the tab and check your Apple, Amazon, or card account directly instead.
Malwarebytes reports that scammers are increasingly tailoring different scams to the platforms where they work best, like unpaid-toll lures via email/SMS, romance scams via social media, and IRS scams via phone calls. The report highlights heavy brand and celebrity impersonation (including MrBeast)…
This article describes real election-themed scams that use fake voter-support messages, political donation appeals, survey prizes, official-looking penalty notices, and bogus campaign merchandise. The scams pressure voters to click fraudulent links, share personal or payment information, download…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
A real campaign is targeting logistics firms with fake Google Play pages impersonating well-known logistics brands to trick employees into installing an Android spyware app. Once installed, the spyware can steal newly received SMS messages (including one-time passcodes) and enable call forwarding,…
