A malicious GitHub repository impersonating Anthropic advertised a “free” Claude Opus 5 desktop app and tricked users into downloading a ZIP that silently installed RevStealer. Victims reported account takeovers after running it, and the malware is designed to steal passwords, crypto wallet data, and other sensitive information while deleting itself to reduce evidence.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you grab a 'free Claude Opus 5 desktop app' from GitHub… and a few hours later, your Microsoft account is taken over. That GitHub repo is fake. It impersonates Anthropic, tells you to download ClaudeOpus5-desktop.zip, you run it, no window pops up, while RevStealer silently starts streaming out your passwords and crypto, then deletes itself. Here’s the tell: it’s offering 'free' access to a premium Claude Opus 5 desktop app from an unofficial GitHub repo. And when you run the installer, nothing normal happens, no setup wizard, no prompts, just silence. If you ever run an installer for Claude, or any tool, and it does nothing, stop and report it to IT immediately. A silent install can mean silent credential theft.
Microsoft describes multiple real-world campaigns where attackers use trusted business workflows to trick people into granting access. One campaign impersonates IT support in Microsoft Teams to get remote control of a device, then spreads across the enterprise. Another campaign targets travelers on…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
