A tracked threat group (UAT-11985) sent tailored event-invitation lures to people tied to Taiwan research organizations, trying to trick them into “registering” through a fake Google Form flow. Victims who clicked a disguised link or scanned a tampered QR code were pushed to a convincing Google sign-in page that captured Google credentials and MFA codes in real time, enabling account takeover.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: a big-name Taiwan policy institute inviting YOU to a geopolitics event, praising your research and asking you to register. You click the 'Google Form' link or scan the QR code on the event poster. A perfect-looking Google Form appears, then suddenly a Google sign-in pops up asking for your password and MFA code. This is an adversary-in-the-middle, or AitM, setup. That fake Google sign-in is proxying the real thing, so when you type your password and MFA, UAT-11985 gets live access to your Google account. Aha rule: if a simple event registration suddenly demands Google login and MFA, stop. Close it and report it to security immediately.
Cisco Talos observed an APT spear-phishing campaign targeting people affiliated with Taiwan research organizations using credible-looking public event invitations. Attackers impersonated well-known academic/policy institutions, used mismatched “safe-looking” registration links, and in some cases…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Researchers describe a real Android banking-trojan operation (Hirudo) that tricks users into installing malware through fake in-app update prompts and fake Google Play-like pages pushed via social media ads. Once installed, it can steal credentials and take over the device, and it can even replace…
Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…
Microsoft warns of an active social engineering campaign where attackers pose as an IT help desk and pressure employees to “update” passkeys/MFA/SSO. Victims are sent to fake Microsoft sign-in pages or tricked into approving access via device-code login, enabling attackers to add their own MFA…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
