An extortion operator compromised a Japanese real estate services company and used shared-hosting credentials to reach nearly 20 related websites. The attacker replaced public homepages with fake maintenance notices, placed ransom demands in admin panels, and prepared messages to pressure the victims’ customers and staff. The later PHP2Shell tooling was found on the attacker’s server but was not tied to the real estate intrusions.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Your real estate company’s homepage suddenly says, ‘System maintenance notice.’ Here’s the trick: it’s the real website, but the notice is fake. It sends visitors to an unfamiliar contact address. Behind it, the admin panel shows a ransom countdown. One stolen SSH key and a reused database password helped spread this across roughly twenty sites. A drafted staff email even warned that ignoring LINE messages wouldn’t help. A real website can carry a fake instruction. Don’t use that address, call the company using a number you already know.
TransUnion reports that criminals are using trusted brands and compromised customer information to trick people into sharing details, one-time passcodes, or access to their accounts. The scams exploit normal-looking security requests and can lead to account takeovers, redirected payments, and…
ASOS confirmed attackers got into customer-data systems after tricking an employee into handing over login credentials. Stolen data reportedly included not only names and contact details, but also customers’ shopping searches, which could enable highly convincing follow-on scams and phishing.…
ReliaQuest disclosed a real social engineering incident where attackers registered a lookalike domain, hosted a fake ReliaQuest SSO page, and called employees while impersonating a named security employee. One employee entered credentials and approved an MFA push, briefly giving the attacker…
Uber Freight is investigating unauthorized access after the Helix extortion group claimed it stole nearly one million files from company cloud and email repositories. Google-linked research says the broader cluster (UNC6671) commonly gets in by calling employees and posing as IT helpdesk staff…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
IEH Corporation disclosed that an attacker got into its Microsoft 365 email environment after an employee clicked what looked like a legitimate Microsoft file-sharing link from a supposed new business contact. The fake link led to a phony login page that captured the employee’s credentials, letting…
