A large phishing campaign sent tens of thousands of emails with SVG attachments disguised as voicemail notifications. The SVG files hid obfuscated JavaScript that, when opened, rebuilt code and contacted a remote endpoint. Many messages also impersonated “internal” senders and slipped past native spam filtering.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email that looks internal: subject says “New voicemail for j.smith” and it’s from your own domain. Feels legit, right? But this two‑month campaign blasted 26,000+ of these. The “voicemail” attachment is actually an SVG file with hidden JavaScript that rebuilds code and calls a remote site, while Microsoft spam scoring says SCL 0 or 1, not spam. Here’s the trick: 95% pretended to be from your own domain, but really came from unknown external senders. The file says voicemail, but the type is SVG or XML, mislabeled as text/plain so scanners think it’s harmless. If you weren’t expecting a voicemail, don’t open the attachment. Report the email in Outlook instead and let security check if that “voicemail SVG” is really a trap.
Researchers reported a real phishing campaign that uses legitimate Microsoft OAuth and Teams pages to make the journey look trustworthy. Instead of hosting a fake login site on a suspicious domain, the attackers render the phishing page inside the victim’s own browser using a temporary “blob URL,”…
Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
U.S. prosecutors say a Russian national used hundreds of fake accounts on a freelance platform to send Excel files that tricked users into enabling macros, which then downloaded remote-control malware. The campaign targeted tens of thousands of users and led to thousands of infections, enabling…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
A real campaign targeting people and organizations in Cambodia uses phishing emails with localized “official-looking” themes to trick recipients into running an installer from a compressed file. Once executed, the malware chain deploys Spark RAT for remote control and uses a vulnerable OPSWAT…
