Attackers are impersonating Bank of America in mass phishing emails to pressure people into clicking a link “to avoid account restrictions.” Mac users are led to a fake login page that steals credentials and personal/financial data, while Windows users are tricked into installing a ScreenConnect remote access tool disguised as “Account Guard,” then it’s deliberately hidden and made difficult to uninstall.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from “Bank of America” warning, “Act now to avoid account restrictions.” Looks legit, right? Click the link, and Mac users see a perfect BoA lookalike login that steals passwords and full account details. Windows users? Same logo, but now it tells you to download a fake “Account Guard” update. Run AccountGuardSetup.zip and a hidden ScreenConnect tool installs itself as a Windows service called “Windows Security” with no prompt. It won’t show in installed apps, but someone now has remote access to your machine. Here’s the move: any “avoid account restrictions” email with a link or software download, don’t touch it. Open the official Bank of America app or type bankofamerica.com yourself and check from there.
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
A real, active phishing campaign impersonating Bank of America tricks victims into downloading a fake “Account Guard” that installs ScreenConnect remote access on Windows, while Mac users are redirected to a credential-stealing page asking for banking and identity details. Separately, Microsoft…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Researchers report multiple real-world email phishing campaigns that used tax and government-benefit themes to trick people into downloading malware. The campaigns used a “crypter” service called Cruciferra to hide malicious files and help malware run while avoiding detection. Targets included…
