The FBI warns that criminals are breaking into social media and personal accounts to steal explicit images and sell or share them online, often with the victim’s personal details attached. The warning highlights specific tactics such as password guessing from breached data, fake “account will be locked” texts that trick victims into sharing verification codes, and phishing emails posing as platform support.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The FBI says criminals are hijacking Snapchat and other accounts just to steal private photos and sell them with your name and phone number attached. Here’s the trick: you get a text saying, 'Your Snapchat account will be locked unless you supply a verification code.' At the same time, Snapchat sends you a real password‑reset code. If you reply with that code, they reset your password and walk right into your account. Same play with email: 'Security alert: new login detected. Change your password using the link below.' The sender is a look‑alike domain, and the link opens a fake login page asking for your username and password. Your move: if any text or email asks for a verification code or wants you to click a password link, stop. Don’t reply, don’t click, go straight to the app or website yourself and check from there.
The FBI says criminals are using social engineering to take over social media accounts, steal explicit content, and sell or post it online along with victims’ personal information. Reported tactics include pretending to be a social media company representative, spamming victims with password-reset…
The FBI warns that criminals are breaking into social media and personal accounts to steal explicit images and sell them online, often bundled with personal details. The advisory describes common social-engineering lures, like fake customer-service texts and phishing emails, that trick people into…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Researchers say a “phishing-as-a-service” kit called Outsider kept generating new scam pages even after a major law-enforcement and industry takedown. The kit supports SMS-based lures that impersonate trusted brands and can capture payment details and MFA codes in real time using…
The FBI warns attackers are impersonating public figures on messaging apps and email to trick targets into approving a malicious OAuth app. Victims are sent links that lead to real Microsoft or Google login/consent screens, where approving access grants attackers ongoing access to emails and files.…
The article describes how attackers use QR codes in emails (“quishing”) to hide malicious links, push victims onto less-protected mobile phones, and steal credentials or MFA tokens. It also cites an FBI notice describing North Korea’s Kimsuky using QR codes in spearphishing emails targeting think…
