A real phishing campaign is using convincing court notices to trick recipients into opening attachments or downloading files that deliver LodaRAT malware. The malware can steal browser session cookies and give attackers remote control of Windows systems. Employees should verify unexpected legal notices through trusted, independent channels before taking action.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“Court Notice: Review the attached legal document.” Got that email? It claims to be from a court and pushes you to open an attachment or download a file. That file can deliver LodaRAT. Here’s the catch: LodaRAT can steal your browser’s active session cookies and remotely control your Windows PC. A convincing notice isn’t proof it’s real. Before opening anything, call the court using its official website’s number, not the email’s.
Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
An unknown group suspected to be North Korean state hackers targeted Rust language team members and high-profile package (“crate”) maintainers with phishing that lures victims into a fake conference call. When the victim tries to join, they are told they must install a “video codec” or update…
Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Three real malware campaigns targeted people in Brazil and Portugal with fake legal notices, invoice pages, and finance-themed documents. Victims were directed to scripts, installers, or an ISO file that abused trusted VLC, VMware, and Microsoft utilities to load malicious code. The most useful…
