The FBI and NCAA warned that criminals are breaking into college athletes’ online accounts to steal intimate photos and then use them for sextortion, harassment, or selling online. The article describes common entry methods like fake “customer support” password-reset requests and credential abuse, and highlights steps athletes and campus teams can take to reduce risk and respond safely.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
FBI and NCAA are warning: college athletes are getting phished, then blackmailed with stolen private photos. One move they use: an email that looks like platform support. Subject line: 'Urgent: Password reset requested, verify now to prevent lockout.' You click, log in, and they quietly walk into your account and grab every intimate photo. Here’s the nasty part: if you reuse that password, one leak can unlock your cloud backup, DMs, everything. Attackers use automated logins, then download private photos for sextortion, harassment, or resale. Your move: if you get an unsolicited password-reset or 'support' message, don’t click it. Open the official app or website yourself and check there instead.
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
The FBI warns that criminals are breaking into social media and personal accounts to steal explicit images and sell them online, often bundled with personal details. The advisory describes common social-engineering lures, like fake customer-service texts and phishing emails, that trick people into…
The FBI says criminals are using social engineering to take over social media accounts, steal explicit content, and sell or post it online along with victims’ personal information. Reported tactics include pretending to be a social media company representative, spamming victims with password-reset…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
IEH Corporation disclosed that an attacker got into its Microsoft 365 email environment after an employee clicked what looked like a legitimate Microsoft file-sharing link from a supposed new business contact. The fake link led to a phony login page that captured the employee’s credentials, letting…
Researchers describe an active, widespread email campaign that tricks employees with voicemail-themed messages and steals Microsoft 365 login sessions (including MFA codes). After taking over accounts, attackers quietly search and collect payroll/HR/finance emails and identify people involved in…
