This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or handing over credentials, which can lead to full enterprise compromise.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a Teams chat pops up, “Hi, this is IT, we need a quick remote session to fix your account.” Looks normal, right? Microsoft’s seen real campaigns where external accounts on Teams impersonate the help desk, then jump to a vishing call and talk people into installing remote tools or granting a full interactive session. Others go further: a shared “document” opens a fake viewer that quietly installs a legit ScreenConnect client wired to their servers, or a one-letter typo like mxsetup.logi.con sends you to a fake download site that gives them mouse and keyboard control. Here’s the move: if “IT” contacts you out of the blue in Teams or by phone and wants a remote session or install, stop and open our official helpdesk portal yourself to verify before you do anything.
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
