Unit 42 reported an espionage-focused intrusion cluster (CL-UNK-1211) targeting government and state-affiliated Linux infrastructure from Oct 2025 to Apr 2026. While much of the campaign is technical (web shells, RATs and reverse shells), it also includes credential theft that relies on deceiving users, such as a fake sudo password prompt designed to look legitimate and quietly capture passwords.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On our Linux admin boxes, even the sudo prompt can be a trap. Unit 42 saw an espionage crew swap .bashrc so every time you run sudo, a fake prompt grabs your password and quietly writes it into a file named Solarwinds.StatusLog.txt. The only clue you see? Sudden or repeated sudo password prompts, or weird new log files in your home directory, while an admin web login quietly logs usernames and passwords to another hidden file. If sudo suddenly feels off, stop. Before you type your password again, check your .bashrc and recent log files or call the security team to verify the box.
A large review of “AI-enabled malware” found most samples were proof-of-concepts, but a small set were real threats seen in production environments. The real-world activity included trojanized installers that pretended to be legitimate apps (like a recipe app or a Dropbox installer) and relied on…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers reported an Iranian state-aligned actor impersonating the Dubai Airports IT department to lure a targeted Iraqi individual into installing a fake “careers portal” and then opening a weaponized coding test. The workflow looked like a real recruitment process (HR questions, then a…
Two real, ongoing intrusion campaigns targeted organizations in Latin America, including a Mexican transportation organization and Brazil’s financial sector. In the Brazil campaign, attackers reportedly got in via a resume-themed phishing attachment, then attempted to download and run tunneling…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
