A real phishing campaign is using fabricated sexual misconduct (Title IX-style) allegations to pressure university staff into clicking a link and installing Zoho Assist, a legitimate remote-access tool being abused as malware. The emails impersonate university leaders and route victims through a Google Drive link to hide the final download. The goal is remote control of the victim’s computer, potentially leading to data theft and broader compromise.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Notification: sexual misconduct concern involving a university student or staff member,” supposedly from a university president. It tells you to click a link, then open a Google Drive file, then click a second link to install something called Zoho Assist to view the “case.” That’s not a process, that’s a trap. Here’s the aha: the misconduct case is fake. The goal is to get Zoho Assist onto your machine so someone else can quietly take remote control of your computer and everything on it. If an email about misconduct tells you to install software or go through a Google Drive link chain, stop. Don’t click, call IT or legal using a known number and have them confirm it.
Researchers reported four separate espionage groups using the same “BlueMoon” exploit kit within days, targeting organizations in the US and Southeast Asia. The attacks began with phishing emails that lured recipients to attacker-controlled websites, where Chrome and Windows vulnerabilities were…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
A real phishing campaign used a generic online event invitation to trick recipients into clicking RSVP/download links. Victims were sent through a fake CAPTCHA and invitation page, then prompted to download a ZIP containing a legitimate ConnectWise ScreenConnect installer abused as a remote access…
Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…
