This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send convincing emails and route victims to fake Microsoft 365 login pages, including adversary-in-the-middle kits designed to bypass MFA.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A LinkedIn recruiter sends you a "coding test" zip and a Google email asks you to log into Microsoft 365. Both can be traps. Iran-linked Mirage Kitten has posed as aviation and fintech recruiters on LinkedIn, pushing devs to run trojanized "coding tests" that drop NodeRabbit and PollCat malware on Windows, macOS, and Linux. At the same time, phishers abuse Google Cloud and AWS so emails pass SPF, DKIM, DMARC, then funnel you through a random CAPTCHA to a fake Microsoft 365 page that can even steal MFA session tokens. Aha moment: if a stranger recruiter wants you to run code, or a cloud email sends you through a CAPTCHA to log in, stop and verify out-of-band before you open the file or type your password.
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Kaspersky reported that Iran-linked APT Mirage Kitten approached software engineers on LinkedIn using fake recruiter personas and sent “coding challenges” that were actually trojanized projects. The lure used legitimate-looking cloud hosting (Amazon S3) and even instructed victims not to use AI…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
