Researchers found that criminals are stealing cloud and AI access, then reselling it through illicit AI services while victims receive enormous cloud bills. In one documented case, a group used a fake portal for LLM users to trick visitors into submitting information containing active access tokens, bypassing passwords and multi-factor authentication.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“Join our group of LLM users.” Sounds useful, right? UNC6993’s fake portal asked visitors to paste connection data. Hidden inside: an active access token. That token can bypass your password and MFA. Here’s the giveaway: a community signup wants your token, not approved sign-in. Stolen access can run AI APIs and rack up over $100,000 a day. If a website asks you to paste an API key or token, stop. Don’t paste it.
Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command…
Google’s threat researchers investigated real attacks in which criminals stole cloud and AI-service access, then ran up charges exceeding $100,000 in a day and, in one case, nearly $1 million. One group used a fake LLM user sign-up portal to trick visitors into providing active access tokens, while…
Researchers report attackers compromising hotel and conference Wi‑Fi gateway equipment to silently redirect travelers to fake Microsoft 365 sign-in pages, without sending phishing emails. In some cases, attackers also abuse Microsoft device-code login prompts so victims unintentionally approve…
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
A real credential-phishing campaign used a project bid invitation and a password-protected PDF to target employees involved in sales and contract work. The PDF led victims through a convincing fake document-sharing site and then to a counterfeit Microsoft sign-in page that sent entered credentials…
A Mandiant assessment showed an internal AI assistant could be socially engineered into abusing its legitimate access. Testers convinced the agent it was part of an authorized security test and gave it a GitHub token, leading it to clone sensitive internal repositories and push them to an external…
