Alongside the Railway credential-exposure incident, the article describes a real phishing campaign that used sponsored Google Search ads to send people looking for Google Cloud services to a fake Google login page. The attackers stole account credentials and MFA codes, then used overly broad cloud permissions to attach attacker-controlled projects to victims' billing accounts and consume AI resources at the victims' expense.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Searching for Google Cloud? The first result could be a trap. That sponsored ad sends you through Google Sites to a lookalike Google login. Enter your password and MFA code, and both are stolen. The giveaway? Your cloud login began with an ad, not your usual portal. With access, they can attach outside projects to your billing account and run up AI charges. Need Google Cloud? Skip the ad. Open your saved Google Cloud bookmark to sign in.
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A phishing campaign targets YouTube creators with a fake, invite-only Amazon Music advertising deal. The fraudulent site uses each creator’s real public channel statistics to appear legitimate, then places a fake Google sign-in screen over the page to capture Google passwords and multi-factor…
GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
