This weekly roundup describes several real social-engineering campaigns, including fake government-payment posts that compromised thousands of Bluesky accounts and mobile scams disguised as community activities. It also documents AI-generated bank-helpdesk calls that persuaded victims to install an app and scan their payment cards, enabling fraud.
This roundup covers three related social-engineering patterns rather than a single incident. In the first, fake posts promoting a government payment offer spread across a social media platform, compromising thousands of accounts before the platform suspended them. In the second, advertisements for community activities such as senior programs, water-based fitness, or recycling services pushed victims toward downloading an Android APK file outside official app stores. Once installed, victims received unsolicited calls from people impersonating government officials or bank representatives, claiming the victim's device or account had been compromised or that they were implicated in a crime. In the third pattern, AI-generated voice clips impersonated banks and companies, warning of suspicious account activity and instructing victims to install an app and scan their bank card by holding it against their phone.
Each scenario relies on a believable pretext paired with urgency. A promise of free government money, a convenient community service, or an urgent bank-security warning all push victims to act quickly instead of verifying. The use of AI-generated voices adds a layer of realism, since scammers could produce dozens of distinct audio clips featuring different banks and scenarios, making the calls sound varied and credible rather than obviously scripted or robotic.
Organizations and individuals can reduce exposure by treating unsolicited calls and social-media offers with skepticism by default. Key habits include never installing apps from links in ads or social posts, independently verifying any bank or government contact through an official number, and refusing to scan payment cards or share credentials because a caller requests it. Since the fraudulent card data in these campaigns was forwarded to criminals for unauthorized withdrawals, the final safeguard is simple: legitimate banks do not ask customers to scan a card against a phone during an unsolicited call. Recognizing that single red flag can stop the entire chain of fraud before any money or data changes hands.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Bluesky said the attack spread through posts promoting a fake offer of a government payment, which compromised more than 4,500 accounts before they were suspended.
According to Singapore Police, after installing the APK victims would receive unsolicited calls from scammers impersonating government officials or bank representatives claiming their device or account was compromised.
Dutch authorities said scammers created dozens of AI-generated audio clips featuring different voices, banks, and companies to warn victims of suspicious account activity and direct them to install an app and scan their bank card.
Treat it as a major red flag, end the call, and contact the bank through a verified number or official app rather than following instructions from the caller.
Your bank calls: ‘Suspicious activity on your account.’ Sounds helpful, right? Dutch authorities found AI-generated bank voices telling people to download an app and scan their payment card. The app forwarded the card’s NFC data, enabling unauthorized withdrawals. That’s the giveaway: a real-sounding voice isn’t proof it’s your bank. The same playbook starts with Facebook activity ads pushing Android APK downloads, then a call claiming your account’s compromised. If a caller asks you to install an app or scan your card, hang up and call your bank using the number on your card.
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
A threat landscape report describes how criminals now buy or rent phishing, fraud, malware, and hidden infrastructure “as a service,” making scams faster to launch and harder to stop. The article highlights practical, repeatable social-engineering workflows such as fake CAPTCHA pages that trick…
A real campaign is targeting logistics firms with fake Google Play pages impersonating well-known logistics brands to trick employees into installing an Android spyware app. Once installed, the spyware can steal newly received SMS messages (including one-time passcodes) and enable call forwarding,…
The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
