A large review of “AI-enabled malware” found most samples were proof-of-concepts, but a small set were real threats seen in production environments. The real-world activity included trojanized installers that pretended to be legitimate apps (like a recipe app or a Dropbox installer) and relied on brand trust and code signing to get users to run them.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You see a shiny new AI app called “Recipe Lister” and a big button: “Install Recipe Lister to quickly find recipes.” Looks harmless, right? Here’s the trick: the installer is trojanized. It’s an NSIS installer that pretends to be Recipe Lister, but when you run it, it quietly extracts and runs a JavaScript backdoor from a temp folder. It was seen across more than 50 organizations. And it’s not just fake recipe apps. One sample masqueraded as a Dropbox installer with a signature that reads “Dropbox, Inc.” The signed file was not Dropbox software at all; it dropped a loader that installed the Oyster, also called CleanBoost, backdoor. That’s the aha: a code signature can lie to you. If any “AI” or brand-name installer pops up from the web, and you weren’t expecting it, especially if it runs scripts from a temp folder, stop and report it to IT. Don’t install it yourself.
Researchers warn about a new macOS infostealer called “CrashStealer” that pretends to be Apple’s Crash Reporter. It uses a legitimate-looking installer and a fake macOS-style password prompt to trick users into unlocking Keychain, then steals credentials and crypto wallet data.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers reported a real campaign by the China-based Silver Fox group against a Japanese industrial manufacturer. The attack starts with an invoice-themed phishing message that leads victims to open a ZIP file, triggering a DLL sideloading chain and installing ValleyRAT for persistent remote…
Researchers at Unit 42 reported a real espionage campaign targeting organizations using Zimbra webmail, including government, defense, transportation and financial sectors. The attackers sent “zero-click” phishing emails disguised as news headlines, where opening/viewing the message could trigger a…
Researchers found 16 look‑alike (typosquatted) RubyGems packages that trick developers into installing a Windows information stealer. The malicious gems run code automatically during installation, pull down additional malware, and then steal browser logins and crypto wallet data before uploading it…
Researchers describe an active campaign ("SMOKE#SCREEN") where attackers trick users with realistic software update and document-themed lures to install a legitimate remote-control tool (ScreenConnect). Once installed, the attacker gains persistent remote access that can look like normal IT…
