A scammer called Graham Cluley while spoofing the real Crime Stoppers phone number and posed as a police detective investigating cybercrime. The caller tried to build trust, claimed to have evidence tied to Cluley (including a passport scan), and steered the conversation toward his Trezor hardware wallet and whether criminals had his 24‑word recovery phrase. A follow-up email claiming to be from the Metropolitan Police attempted to pressure him into cooperating.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Your phone rings. Caller ID says Crime Stoppers, 0800 555 111. A calm voice: “Hello, this is Detective David Pullen.” He sounds legit, knows your phone and email, says he’s on a cybercrime case. Then he pivots: do you have a Trezor wallet, how much crypto, do criminals have your 24-word seed key? Later, an email shows up, claiming to be the Metropolitan Police, hinting you could face action if you don’t cooperate. The headers tell the truth: it’s forged, from somewhere else. Here’s the rule: if anyone on a call or email asks for your 24-word recovery phrase, hang up, ignore the email, and contact the organisation using a number or website you look up yourself.
Scammers are mailing official-looking “IRS” letters to cryptocurrency holders, urging them to scan a QR code and enroll in a fake “Digital Asset Compliance Portal.” The QR code leads to a fraudulent IRS-lookalike site that gathers wallet/exchange details and then prompts victims to provide a phone…
Microsoft reports billions of phishing attempts in Q2 2026, with attackers increasingly using attachments (PDF/DOC/HTML) and new formats like calendar invites to trick employees into entering credentials. The report also highlights continued growth in Teams-based social engineering and notes that…
A June 2026 financial-sector threat report describes real phishing emails that used business-looking themes (e.g., money transfers, receipts, voicemail) to push victims to malicious links or HTML attachments that mimic login pages. The report also highlights cases where stolen account information…
Proofpoint observed real phishing campaigns using government-themed lures to trick people into downloading ZIP files that install malware. The campaigns used a “crypter” service called Cruciferra to help common remote-access and data-stealing malware evade detection. Financial services, healthcare,…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
Google reports UNC6671 is still actively compromising organizations by calling employees and pretending to be IT helpdesk staff running an urgent security migration. Victims are pushed to visit lookalike login pages that steal passwords and MFA codes, which then enables data theft and extortion…
