The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code authorization, followed by cloud data theft from SharePoint, OneDrive, and Exchange.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a call: “Hi, this is the helpdesk. We’re finalizing your passkey and SSO setup, need you to enroll now.” Sounds legit, right? Then a text hits your personal phone: “Passkey setup required: use this link to finish enrollment for SSO.” You tap, a browser opens, and a perfect-looking Microsoft login appears, but it’s an AiTM phishing page or device-code flow stealing your session. Here’s the twist: passkey cryptography isn’t being broken at all. The “passkey setup” is just the cover story. Once you approve, they quietly add their own authentication method, then spend hours pulling data from SharePoint, OneDrive, and Exchange under your identity. If anyone calls or texts you about passkey, MFA, or SSO setup, don’t use their link or number, hang up, then contact the helpdesk through our official portal or known support channel instead.
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
Microsoft reports active intrusions where attackers trick employees with “passkey/SSO update” helpdesk pretexts delivered by phone, SMS, or even Microsoft Teams. Victims are sent to lookalike Microsoft sign-in pages or guided through device-code sign-in, letting attackers capture session access and…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
