This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send convincing emails and route victims to fake Microsoft 365 login pages, including adversary-in-the-middle kits designed to bypass MFA.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A LinkedIn recruiter sends you a "coding test" zip and a Google email asks you to log into Microsoft 365. Both can be traps. Iran-linked Mirage Kitten has posed as aviation and fintech recruiters on LinkedIn, pushing devs to run trojanized "coding tests" that drop NodeRabbit and PollCat malware on Windows, macOS, and Linux. At the same time, phishers abuse Google Cloud and AWS so emails pass SPF, DKIM, DMARC, then funnel you through a random CAPTCHA to a fake Microsoft 365 page that can even steal MFA session tokens. Aha moment: if a stranger recruiter wants you to run code, or a cloud email sends you through a CAPTCHA to log in, stop and verify out-of-band before you open the file or type your password.
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
