Researchers report two Android banking malware families (ToxicPanda 2.0 and GoldDigger) that rely on tricking people into installing malicious apps and granting powerful permissions. GoldDigger campaigns impersonate airlines and shopping retailers and then abuse Android Accessibility to take over banking apps and initiate fraudulent transfers from the victim’s device.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You install a “special offer” airline app… and ten minutes later, money is moving out of your banking app by itself. That’s GoldDigger and ToxicPanda 2.0, Android banking malware hiding in fake airline and shopping apps, often hosted on Amazon AWS buckets. After install, they pop up a friendly message: “To work properly, please enable Accessibility services.” Here’s the nasty part: once you tap Allow, they abuse Accessibility to mimic your taps inside banking apps, use overlays to steal your PIN, and even throw up a full-screen fake “System update in progress” to hide what’s really happening. Your move: if any airline or shopping app asks for Accessibility or Device Administrator, stop right there and deny it, no exception.
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers report Iranian-linked APT groups using legitimate cloud services to hide command-and-control traffic, and separately running spear-phishing campaigns. In the phishing cases, attackers used credible “podcast” or “interview invitation” themes to persuade targets to open a Windows shortcut…
Researchers found 737 Chrome VPN/proxy extensions that impersonated well-known privacy brands and routed users’ browser traffic through attacker-controlled SOCKS5 proxies. The activity mainly targeted Russian-speaking users trying to access blocked services, putting the operator in a position to…
Researchers simulated “pig butchering” romance-style scams and found an AI chatbot built trust more effectively than a human scammer over a week of texting. In the test, victims were significantly more likely to comply with the AI’s request to install an app, showing how AI could automate the long…
Researchers demonstrated a new “agent data injection” technique where attackers plant content (like a review or GitHub comment) that an AI agent mistakenly treats as trusted system data. In tests, this caused web-browsing agents to click the wrong buttons (e.g., “Buy Now”) and coding agents to run…
