The FBI and NCAA warned that criminals are breaking into college athletes’ online accounts to steal intimate photos and then use them for sextortion, harassment, or selling online. The article describes common entry methods like fake “customer support” password-reset requests and credential abuse, and highlights steps athletes and campus teams can take to reduce risk and respond safely.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
FBI and NCAA are warning: college athletes are getting phished, then blackmailed with stolen private photos. One move they use: an email that looks like platform support. Subject line: 'Urgent: Password reset requested, verify now to prevent lockout.' You click, log in, and they quietly walk into your account and grab every intimate photo. Here’s the nasty part: if you reuse that password, one leak can unlock your cloud backup, DMs, everything. Attackers use automated logins, then download private photos for sextortion, harassment, or resale. Your move: if you get an unsolicited password-reset or 'support' message, don’t click it. Open the official app or website yourself and check there instead.
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
The FBI warns that criminals are breaking into social media and personal accounts to steal explicit images and sell them online, often bundled with personal details. The advisory describes common social-engineering lures, like fake customer-service texts and phishing emails, that trick people into…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
CISA warns a Russian state-sponsored group (“Laundry Bear,” tracked by Microsoft as “Void Blizzard”) is compromising some unpatched Zimbra email accounts when users merely open or preview a specially crafted email. The hidden code can steal passwords, MFA-related tokens, and up to 90 days of…
