Researchers linked the uCreator Android spyware kit to real campaigns that used ads and fake app-store sites to distribute tampered Telegram X apps. The sites marketed Telegram X as a dating and video-chat app, persuading victims to sideload it; once installed, the altered app could steal Telegram two-step-verification passwords and help attackers take over accounts.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Telegram X as a dating app? That’s your first clue. That ad opens a fake app-store page and pushes an Android download. Doctor Web found tampered Telegram X copies spreading this way. They still work like Telegram. That’s the trick: a working app can still steal your Telegram two-step-verification password and hide an unwanted session. The familiar app name doesn’t prove it’s safe. See Telegram X in an ad or on a download page? Skip it. Install only from your approved official app store.
A commercial Android spyware kit called uCreator hides inside modified versions of legitimate messaging apps, including Telegram X. Victims who sideload these lookalike apps may expose Telegram two-step verification passwords or have WeChat account data copied, even while the altered app continues…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
UK and allied agencies warn that a Tehran-backed operation is targeting dissidents, activists, and journalists using social engineering to trick them into installing spyware called “Chosen Brick.” Attackers build trust on social media by impersonating known contacts or “technical support,” then…
Researchers say criminals are abusing Google Play’s “Early Access” program to distribute deceptive apps that promise cash, rewards, or casino winnings. The apps are promoted through social media ads (including AI celebrity deepfakes) and use a “never-ending payout” loop to keep people watching ads…
