Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings and reviews but steal data and reroute searches.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You search for “Download Claude for desktop” and land on a slick install page that looks totally legit. This is an InstallFix-style fake Claude page. It walks you through copying an mshta command from the site to “finish setup”, but that command quietly pulls malware from a lookalike domain. Same play with a fake Perplexity Chrome extension: 4.7 stars, 10,000 installs, looks perfect. But once installed, it hijacks your searches, routes them through a lookalike site, and streams your browsing data out in real time. Here’s the move: if a Claude or Perplexity install ever tells you to run a command from a web page or install an extension that changes how your browser behaves, stop and get it only from the official vendor site yourself.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
Researchers showed how a malicious web page could trick OpenAI’s Atlas AI-enabled browser into taking actions a user didn’t intend, like spamming WhatsApp contacts or modifying an Amazon account. The attacks used prompt-injection style instructions hidden in a seemingly legitimate “newsletter…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
