Researchers documented a real phishing method where attackers push fake bank sites up in search results, then show different content depending on how a person arrived. If someone clicks from a poisoned search result, the site shows a realistic bank login page to steal credentials; if security teams visit directly, it shows a harmless “offline” page to evade scanning. Defenders are advised to validate suspicious URLs using referrer spoofing and browser emulation because a direct visit may hide the scam.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You Google your bank, click the top result, and the site looks a little slow… no big deal, right? Behind that click is a trick called Chameleon SEO Poisoning. From search, you get a perfect fake bank login. But if IT types the same address in directly, it plays dead and shows a harmless offline page. Researchers are seeing more of this: typosquatted bank sites boosted in search, using presentation control to steal logins while dodging our scanners and even manual checks that just type the URL in. Here’s the move: never log in to your bank from a search result. Use your saved bookmark or the official banking app every time.
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
Researchers observed phishing sites that appear “dead” to security scanners but turn into convincing fake bank login pages when a victim arrives from poisoned Google/Bing search results. The goal is to steal banking credentials while keeping the malicious pages online for days or weeks by showing…
A new Android malware family called “Manic” is being used in real campaigns targeting banking, government identity, and messaging apps, especially in Ukraine and parts of Europe. It spreads through phishing sites and “dropper” apps disguised as legitimate utilities (including a booking-app lure),…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
