Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people to click links or run commands.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“Payment failed for your Claude account.” That email can wait. It says your API access and Claude seats will be paused. Click “Update payment method,” and the page asks for both your card and account credentials. That’s the tell: a payment fix that also wants your login. Familiar branding proves nothing. Fake Google Antigravity pages even hide executable instructions inside installation commands. Got that Claude email? Skip its button. Open Claude from your saved bookmark and check billing there.
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Researchers report a new PamStealer variant that lures macOS users to a fake cryptocurrency wallet website and tricks them into running a script-based installer. The malware downloads a decryption tool and relies on a live server key exchange, making the real payload harder to analyze and helping…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious…
