The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted vishing/phishing operation targeting cryptocurrency users, showing how attackers are scaling outreach and targeting.
This roundup covers three distinct social engineering patterns that share a common thread: manipulating people rather than exploiting software alone. In the first, attackers posed as a bank fraud team calling to warn victims of suspicious account activity. Victims were pressured to install an app that was actually the SpyNote remote access Trojan, giving attackers control of the phone and enabling remote NFC transactions, unauthorized loans, and contactless payment fraud.
In the second pattern, fake software download pages used a ClickFix-style technique, instructing users to run commands in order to complete an installation or fix an error. Instead, these commands installed malware that stole credentials and browser data, with hijacked Chromium sessions potentially giving attackers access to corporate email, cloud services, and administrative accounts.
The third pattern, tied to what the article calls Operation ASTERIX, used AI tooling (Claude Code) to screen more than 100,000 phone numbers before targeting cryptocurrency users with phishing, voice phishing, and fake wallet software.
Each scenario relied on urgency and authority. A call claiming to be from a bank's fraud team creates immediate pressure to act, especially when it involves potential loss of money. Fake download pages exploit the routine trust users place in software installation prompts. Crypto-themed outreach plays on fear of losing funds. In all three cases, victims were pushed toward one action: install something or run a command, at the direction of someone they did not independently verify.
Organizations can reduce exposure to these tactics with a few practical steps:
These incidents illustrate that sophistication in modern social engineering often comes not from complex malware alone, but from convincing pretexts that get a person to take one small, seemingly reasonable action.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers called victims posing as a bank fraud team, claimed suspicious activity was occurring, and convinced them to install an app that led to the SpyNote remote access Trojan, enabling remote NFC fraud and unauthorized transactions.
It is a technique where a fake software download page instructs users to run commands to complete or fix an installation, which instead installs malware that steals credentials and browser data.
Operation ASTERIX reportedly used Claude Code to screen more than 100,000 phone numbers, then targeted cryptocurrency users through phishing, voice phishing, and fake wallet software.
Independently verify calls claiming to be from financial institutions using a known number, avoid installing apps at a caller's direction, and be wary of instructions to run commands to fix a download.
Imagine this: your phone rings, “Hi, this is the bank’s fraud team, we see suspicious activity on your account.” They sound legit, then tell you to install a “security app.” In real attacks, that app was SpyNote, letting them take over phones and run NFC payments and even loans remotely. Same play on Macs: a fake download page says, “Your download is ready, if installation fails, run these Terminal commands to complete the fix.” That ClickFix-style trick has been used to steal browser logins and hijack Chromium sessions into corporate email and cloud. Here’s the move: if anyone, on a call, in a pop-up, or a download page, tells you to install an app or run commands, stop and verify through a known-good channel you choose, not the one they give you.
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
A Russia-linked threat group compromised hotel WiFi captive portals to redirect guests to fake “verification” pages. Victims were pushed toward either copying commands into a terminal to install malware or entering Microsoft credentials on spoofed login pages that added an attacker-controlled…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
