Cofense analyzed real phishing emails disguised as bidding invitations. The emails send recipients to fake, branded login and device-enrollment pages, then trick them into entering a device code in a genuine Microsoft prompt. Doing so can authorize an attacker’s session without giving them the victim’s password and may bypass normal MFA protection.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“Invitation to bid, view the project details.” Sounds routine, right? The link opens a Syncfusion-branded login, then a fake Mimecast device-enrollment page. It says IT policy requires a code before you can see the document. Here’s the catch: the Microsoft code window is real. Entering that website’s code can authorize someone else’s session, no password needed, even with MFA. Unexpected bid asks for a device code? Don’t enter it. Verify the invitation through a contact you already trust.
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000…
Attackers broke into the email account of a CDU Heilbronn district executive and used the trusted mailbox to send roughly 6,500 fake messages. The emails used an event invitation as a lure and directed recipients to a link for a supposed document, making this a credible internal-email phishing…
Attackers are abusing legitimate services such as Dell and Staples to send real, authenticated emails containing fraudulent support phone numbers. The emails pass normal authentication checks because the trusted platform sends them, but the attacker controls fields displayed in the message and uses…
