The FBI says criminals are using social engineering to take over social media accounts, steal explicit content, and sell or post it online along with victims’ personal information. Reported tactics include pretending to be a social media company representative, spamming victims with password-reset texts/codes, and using cloned login pages to steal credentials.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine waking up to find your private photos posted from your own account. That’s what these reset-code scams are doing. Here’s the trick: you get a text saying, 'Security Alert: Your account has been breached. Reply with the verification code we just sent to secure your account.' At the same time, a real reset code from your app pops up. If you reply with that code, they own your account. They may also push you to a cloned login page that says, 'Your account requires verification. Please sign in to restore access.' The page looks right, but the URL is wrong and you got there from a random link. Type your password there, and it’s sent straight to them. Aha moment: that reset code is a key, and anyone who has it can walk into your account. One rule: never share verification or reset codes with anyone, if someone asks for a code, it’s a scam.
The FBI warns that criminals are breaking into social media and personal accounts to steal explicit images and sell them online, often bundled with personal details. The advisory describes common social-engineering lures, like fake customer-service texts and phishing emails, that trick people into…
The FBI warns that criminals are breaking into social media and personal accounts to steal explicit images and sell or share them online, often with the victim’s personal details attached. The warning highlights specific tactics such as password guessing from breached data, fake “account will be…
The FBI warned that scammers are impersonating IC3 leadership using AI-generated (deepfake) videos and spoofed IC3 websites to trick prior fraud victims into sharing more personal and financial information. In one example, victims are contacted on Facebook Messenger by someone posing as an FBI…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
