A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters inserted into financial lure words.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You know that box that says, “This app wants to access your email and files”? That click can hand over your whole account. FBI’s warning: attackers use OAuth consent phishing. They impersonate a manager or vendor, email you, “Please approve this app so I can share the documents,” then a legit-looking Microsoft-style screen asks to read your mail and files, no password theft needed. At the same time, Microsoft saw millions of phishing emails using invisible Unicode in words like “funding” to dodge filters, and fake bank sites hiding behind sponsored search ads that steal logins when you search for your bank. If any email or pop-up asks you to approve an app for email or file access, stop and forward it to the security team before you click Approve, one check now beats handing over your account for good.
Anthropic says it disrupted a Russian state-linked campaign that used Claude to continuously rebuild malware when security tools detected it. The group (GTG-20006, linked to Midnight Blizzard/APT29) ran phishing and other human-targeted schemes, including device-code token theft against Microsoft…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
CISA warns a Russian state-sponsored group (“Laundry Bear,” tracked by Microsoft as “Void Blizzard”) is compromising some unpatched Zimbra email accounts when users merely open or preview a specially crafted email. The hidden code can steal passwords, MFA-related tokens, and up to 90 days of…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
