A real malware campaign dubbed “MovieReaper” infected users who tried to download popular movies from torrent trackers. Attackers abused a compromised public torrent-file repository so that magnet links returned a different torrent that downloaded a Windows .exe disguised as a movie file, which users then ran manually.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You grab a torrent for a new movie… but the “movie file” is actually a Windows app called the odyssey (2026) [1080p] [webrip] [5.1].exe. In the real MovieReaper campaign, attackers compromised a torrent-file repository called itorrents.org, so magnet links quietly returned a different torrent that dropped this fake movie installer. When you run it, MovieReaper installs itself as msedge.exe under ProgramData\Microsoft\Windows\Telemetry, phones home to a first-stage server, then even uses the Solana blockchain to look up its next control servers. Aha moment: real movies are .mp4 or .mkv, not .exe. If your “movie” download ends in .exe, stop. Don’t run it, report it to Security immediately.
Microsoft reports an active campaign where attackers set up counterfeit software download pages that mimic well-known brands and trick users into installing malware. Victims visit a look-alike vendor site, click “Download now,” then run a bundled installer that drops persistent malware and connects…
An active campaign (“Phantom Raven”) targets developers by exploiting AI coding assistants that suggest non-existent package names. Attackers register those hallucinated names in public repositories and plant malicious code so that automated installs can quietly introduce malware into build…
Researchers reported a targeted espionage operation against Bangladesh’s military and defense organizations using spear‑phishing emails with a booby‑trapped RTF document. When opened, the file pulls malicious content remotely and installs an implant that persists on the device while quietly sending…
Cisco Talos reports a real campaign by a Russian-speaking group (UAT-11795) targeting users in the U.S. and Europe with trojanized installers for popular tools like Zoom, Webex, and MobaXterm. Victims are socially engineered via a “ClickFix” style trick into running a command that silently…
A real, ongoing phishing campaign is tricking recipients into opening malicious archives that appear to contain harmless TrueType font files (.ttf) but actually hide a Lua-based loader. Once executed, the loader uses stealthy, mostly in-memory techniques to install remote access trojans and…
Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links…
