U.S. prosecutors say a Russian national used hundreds of fake accounts on a freelance platform to send Excel files that tricked users into enabling macros, which then downloaded remote-control malware. The campaign targeted tens of thousands of users and led to thousands of infections, enabling credential theft and remote access to victims’ computers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine a 'new client' on a freelance site sending you an Excel file and saying, "Enable macros to see the project details." Prosecutors say someone ran roughly 255 fake freelancer accounts like this, blasting malware‑laced Excel files to about 80,000 users. The macro they enabled quietly pulled in TVRAT and DarkVNC, giving remote control of thousands of computers. Once in, those tools stole e‑commerce logins and other personal data while the screens looked totally normal. The only real clue was the setup: a brand‑new contact, an unexpected Excel, and pressure to turn macros on. If a new or untrusted contact sends an Excel and tells you to enable macros, stop and ask for a PDF or a platform message instead, do not turn macros on.
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Researchers report Iranian-linked APT groups using legitimate cloud services to hide command-and-control traffic, and separately running spear-phishing campaigns. In the phishing cases, attackers used credible “podcast” or “interview invitation” themes to persuade targets to open a Windows shortcut…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
