A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters inserted into financial lure words.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You know that box that says, “This app wants to access your email and files”? That click can hand over your whole account. FBI’s warning: attackers use OAuth consent phishing. They impersonate a manager or vendor, email you, “Please approve this app so I can share the documents,” then a legit-looking Microsoft-style screen asks to read your mail and files, no password theft needed. At the same time, Microsoft saw millions of phishing emails using invisible Unicode in words like “funding” to dodge filters, and fake bank sites hiding behind sponsored search ads that steal logins when you search for your bank. If any email or pop-up asks you to approve an app for email or file access, stop and forward it to the security team before you click Approve, one check now beats handing over your account for good.
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Anthropic says it disrupted a Russian state-linked campaign that used Claude to continuously rebuild malware when security tools detected it. The group (GTG-20006, linked to Midnight Blizzard/APT29) ran phishing and other human-targeted schemes, including device-code token theft against Microsoft…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
