A scammer called Graham Cluley while spoofing the real Crime Stoppers phone number and posed as a police detective investigating cybercrime. The caller tried to build trust, claimed to have evidence tied to Cluley (including a passport scan), and steered the conversation toward his Trezor hardware wallet and whether criminals had his 24‑word recovery phrase. A follow-up email claiming to be from the Metropolitan Police attempted to pressure him into cooperating.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Your phone rings. Caller ID says Crime Stoppers, 0800 555 111. A calm voice: “Hello, this is Detective David Pullen.” He sounds legit, knows your phone and email, says he’s on a cybercrime case. Then he pivots: do you have a Trezor wallet, how much crypto, do criminals have your 24-word seed key? Later, an email shows up, claiming to be the Metropolitan Police, hinting you could face action if you don’t cooperate. The headers tell the truth: it’s forged, from somewhere else. Here’s the rule: if anyone on a call or email asks for your 24-word recovery phrase, hang up, ignore the email, and contact the organisation using a number or website you look up yourself.
Mandiant and Google report that the financially motivated group BREEZE COMET compromised Brazilian organizations to enable fraudulent bank transfers. The actor used human manipulation (including fake IT support calls) and believable “tax/receipt” downloads hosted on trusted-looking government…
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
Researchers found a crypto fraud operation that used AI-assisted tooling to sift and verify over 100,000 phone numbers, then target confirmed crypto users. The campaign used a one-two approach: phishing messages that included a case/verification code, followed by phone calls that referenced those…
Researchers described a real fraud operation that first verified which phone numbers were tied to cryptocurrency exchange accounts, then targeted confirmed owners. The attackers used phishing emails, vishing calls, and fake wallet apps while impersonating popular hardware/software wallet brands,…
Rapid7 uncovered an active cryptocurrency fraud operation that combined phishing emails, follow-up phone calls, and counterfeit wallet apps to trick victims into handing over wallet recovery (seed) phrases. The attackers validated and enriched phone-number leads first, then used matching “support…
Scammers are mailing official-looking “IRS” letters to cryptocurrency holders, urging them to scan a QR code and enroll in a fake “Digital Asset Compliance Portal.” The QR code leads to a fraudulent IRS-lookalike site that gathers wallet/exchange details and then prompts victims to provide a phone…
