The article describes real malware-delivery operations that use fake open-source download sites, advertising redirects, and device profiling to decide who receives malicious content. Attackers hide the final payload behind ordinary-looking pages and scripts, while sending researchers, bots, and some devices to harmless decoys. For awareness teams, the practical lure is a convincing software-download page that leads users into a hidden redirect chain.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
That open-source download page looks real. The Download button is the trap. One reported chain loaded a staging script from Amazon CloudFront, then handed visitors to a traffic distribution system. The page could look harmless while that happened. Here's the twist: a hidden iframe can check your OS version. Bot and IP filters may show someone else a harmless page, while your device gets a matching .min.js script. Need work software? Skip the lookalike page. Download it from the verified vendor or official project site.
Attackers used fake ChatGPT, Claude, and Cursor AI application listings to trick Windows users into downloading malware. The downloads appeared trustworthy because they were hosted through GitHub and included real, digitally signed OpenAI or Anthropic executables, but malicious files alongside them…
Researchers found criminals using World Cup-themed Instagram advertisements, compromised websites, and abandoned analytics tags to expose iPhone users to Coruna and DarkSword spyware kits. The attacks can begin when malicious advertising or web content loads, with little or no action beyond…
The article warns that AI is making impersonation and social engineering more convincing, citing a real 2024 case where Arup was reportedly tricked during a video conference featuring a digitally cloned senior manager. The core lesson is to validate requests through policy and independent…
Check Point Research identified a real campaign, tracked as Yoba, that uses fake GitHub projects and websites posing as new ChatGPT and Claude desktop applications. Victims searching for AI tools can be directed to convincing pages for supposed releases such as GPT-6 Astra and Claude Opus, then…
Criminals compromised legitimate websites and replaced normal content with fake verification pages designed to persuade visitors to install malware. The pages use familiar frustrations, such as a blocked video, a browser problem, or a security check, to pressure people into running commands or…
Researchers found ROMULUS, a malware-delivery platform that uses fake web pages and ClickFix-style prompts to persuade people to run harmful commands themselves. The platform can deliver Legion Loader and other malware through a PowerShell script, showing how a seemingly routine verification or fix…
