This bulletin describes multiple real-world scams where attackers manipulate trust to steal money or sensitive data. Notably, attackers impersonated executives to pressure legal teams into moving M&A discussions to WhatsApp/personal email to trigger international wire transfers, and Trezor users were targeted with a “critical security alert” phishing email pushing a malicious app to steal wallet backups.
In this scheme, attackers impersonated a company executive or a supposedly reputable adviser and framed an acquisition as a tightly controlled, confidential transaction involving only a small group of people. Legal and finance staff were pressured to move the conversation off normal company channels and onto WhatsApp or personal email, citing confidentiality. The attackers then pushed for an international wire transfer, supported by forged acquisition documents, while emphasizing that a public announcement was imminent.
The scam leaned on urgency, secrecy, and authority at the same time. Framing the deal as confidential discouraged targets from checking with colleagues, while the compressed timeline between the NDA and the supposed announcement reduced the chance that anyone would pause to verify the request through normal channels. Impersonating executives or a trusted adviser added a layer of authority that made the unusual channel switch seem justified rather than suspicious.
Separately, Trezor users received an email titled Critical Security Alert: STM32 Entropy Vulnerability after Trezor's email provider, Brevo, was breached. The email was not from Trezor and directed recipients to download an app that asked them to enter their wallet backup, effectively asking victims to hand over the seed phrase that protects their cryptocurrency. Trezor explicitly warned customers not to click the link.
A large-scale operation known as DoppelCart used more than 119,000 domains to run fake e-commerce shops. Each site copied a real brand's photos and page text, then undercut the brand's prices to attract buyers. Notably, these fake stores republished the real brand's own support contact address, so customers who were charged fraudulently ended up complaining to the legitimate company rather than the scammers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers impersonate executives or a trusted adviser, claim a confidential acquisition is underway, and pressure legal and finance staff to move discussions to WhatsApp or personal email before requesting an international wire transfer using forged acquisition documents.
Trezor warned that an email titled Critical Security Alert: STM32 Entropy Vulnerability was a phishing attempt sent after its email provider was breached, directing users to download an app and enter their wallet backup.
DoppelCart is a large-scale fake e-commerce operation using over 119,000 domains to clone real retail brands, undercut their prices, and steal payment card details, while reusing the real brand's support contact so complaints go to the legitimate company.
Treat the request as a major warning sign, refuse to shift sensitive discussions off approved channels, and verify the request through known internal contacts before taking any action.
Imagine this: your GC gets a secret M&A email from the CEO, NDA attached, announcement 'imminent,' and a note to move everything to WhatsApp. That’s the setup: someone masquerading as execs and 'reputable advisers,' pushing legal to WhatsApp and personal email so they can rush forged acquisition docs and an international wire. Same playbook hits Trezor users: email titled 'Critical Security Alert: STM32 Entropy Vulnerability' telling you to click a link, download an app, and type in your wallet backup, your entire crypto, gone. If a deal or a ‘security alert’ email ever pushes you to WhatsApp, personal email, or to enter a wallet backup, stop and verify it yourself using our official internal channels, before you move a cent.
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Researchers described a real fraud operation that first verified which phone numbers were tied to cryptocurrency exchange accounts, then targeted confirmed owners. The attackers used phishing emails, vishing calls, and fake wallet apps while impersonating popular hardware/software wallet brands,…
Attackers abused access to a third-party email newsletter provider to send convincing “security alert” emails from legitimate-looking crypto company domains. The emails pushed users to click links that led to phishing sites designed to look nearly identical to real platforms. Trezor, CoinTracking,…
