Three real malware campaigns targeted people in Brazil and Portugal with fake legal notices, invoice pages, and finance-themed documents. Victims were directed to scripts, installers, or an ISO file that abused trusted VLC, VMware, and Microsoft utilities to load malicious code. The most useful awareness lesson is to treat unexpected legal, invoice, and download requests as suspicious even when they appear to use familiar software.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A notary emails: “View your protest document.” You weren’t expecting one. The link says “visualizar-protesto.pdf/cnpj=” plus your company number. But it downloads a VBScript, not a PDF. That script fetches an installer. Another page says “Download Seguro – Factura.” Its fake CAPTCHA delivers an ISO. Inside, a malicious DLL rides alongside a real VMware utility. Familiar software doesn’t make the file safe. Unexpected legal notice or invoice? Don’t use its link. Verify it through a contact you already know.
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious…
A Japanese industrial manufacturer was targeted by the SilverFox group using an invoice-themed phishing email that kicked off a multi-stage malware chain. The campaign abused legitimate software and cloud services to load a malicious DLL, disable security tools, and establish remote access with…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
