The discussion highlights real malicious advertising and search-result poisoning campaigns that lure people looking for AI tools into downloading credential-stealing malware. Attackers make fake AI-tool links appear trustworthy by using sponsored search links and legitimate hosting platforms, making developers and other employees more likely to click and download.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Searching for Claude Code? The top result could be the trap. A Google Ad says, 'Hey, download Claude Code.' You click, land on a convincing page, and the download installs an infostealer that grabs your credentials. Here's the catch: Cloudflare Pages or an OpenAI Custom GPT can host the lure. Familiar platform, wrong download. Sponsored placement isn't vendor approval. Need Claude Code? Skip the ad. Get it from your approved software catalog or the vendor's verified site.
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
Researchers observed threat actors creating attacker-made ChatGPT Custom GPTs that look legitimate, then steering users to a Google Sites “backup domain.” Victims are shown a fake Cloudflare CAPTCHA that tricks them into copying and running a malicious PowerShell command, which downloads and runs…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
A commonly used documentation placeholder domain, third-party.com, was registered by an unknown party and is now serving a ClickFix social-engineering lure to Windows users. The page pretends to run a Cloudflare security check, silently poisons the clipboard, and tells victims to paste and run a…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
