Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings and reviews but steal data and reroute searches.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You search for “Download Claude for desktop” and land on a slick install page that looks totally legit. This is an InstallFix-style fake Claude page. It walks you through copying an mshta command from the site to “finish setup”, but that command quietly pulls malware from a lookalike domain. Same play with a fake Perplexity Chrome extension: 4.7 stars, 10,000 installs, looks perfect. But once installed, it hijacks your searches, routes them through a lookalike site, and streams your browsing data out in real time. Here’s the move: if a Claude or Perplexity install ever tells you to run a command from a web page or install an extension that changes how your browser behaves, stop and get it only from the official vendor site yourself.
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
