Cisco Talos reports a real cryptocurrency-theft campaign where criminals trick people into pasting JavaScript into their browser or installing it via the Tampermonkey extension. The lure pretends to be a leaked vulnerability report for crypto swap sites, but the “exploit” is fake and instead injects a web-skimming script that swaps deposit addresses to steal funds. The attackers also abuse Google Sheets/Docs (via the Google Visualization API) for command-and-control, hiding activity inside normal-looking Google traffic.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine a Telegram post titled “API Logic Flaw” promising a 25% crypto bonus if you run a secret browser exploit. The trick? They tell you to paste JavaScript into Chrome’s address bar, or install Tampermonkey and add a script from paste.sh, to ‘activate’ the bonus on SimpleSwap.io. Behind the scenes, that script pulls more code from a Google Sheet via the Google Visualization API, then skims your browser, silently swapping crypto deposit addresses on the page and in your clipboard. Here’s the rule: if anyone tells you to paste code into your browser or install a script for extra payouts, stop immediately and report it to Security.
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
A real phishing campaign is targeting DEF CON speakers and attendees through X/Twitter messages pretending to be a Coindesk executive. Victims are sent to a Google document that attempts a “click-fix” trick to get them to paste malicious commands into a terminal or download malware. The goal is to…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
