Barracuda reports attackers are abusing fake CAPTCHA pages as a “trust step” to push victims into credential theft, malware downloads, and enabling malicious browser notifications. In some “ClickFix” variants, the CAPTCHA flow tricks users into pasting and running a command on their own Windows device, which then starts the infection.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You click an invoice link, and before anything loads, boom, full-page CAPTCHA: “Verify to view document.” That fake CAPTCHA is the trust trick. After you click it, you land on a counterfeit Microsoft 365 sign-in, sometimes even after an Adobe-style prompt, built to steal your password. The nastier ClickFix versions go further: you click 'Verify', it silently copies a command, then tells you, step-by-step, to open Windows Run, paste, and hit Enter, so you infect yourself. If a ‘CAPTCHA’ leads to a login page or tells you to run a command, stop. Close it and report it to IT or Security, don’t click, don’t paste, just report.
Attackers are sending fake ChatGPT billing emails that pressure people to “update payment” within 48 hours to avoid service interruption. The message links to a convincing look‑alike ChatGPT login page via a Google redirect, aiming to steal OpenAI credentials.
Cofense observed a real phishing email that impersonates OpenAI/ChatGPT billing to trick users into “updating” payment details. The email uses the real ChatGPT logo, urgency (“48 hours”), and a prominent button to drive clicks to a lookalike ChatGPT login page. Any credentials entered are harvested…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
China-linked attackers targeted NGOs with spear-phishing emails that urged recipients to click a link to a legitimate U.S. university website. The link path abused a website flaw to silently redirect victims to attacker infrastructure, which then exploited Chrome and Windows to install malware…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
