The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately, researchers observed a “passkey”-themed campaign using phone and text messages to drive employees to lookalike Microsoft 365 sign-in pages to take over accounts.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a real government email address asks you for customer records. Revolut replied to one… and exposed full KYC and financial data. The trick? Two plays. One: a massive email-only ask for identity documents, selfies, IBANs, and full transaction histories, all waved through just because the address ended in .gov. Two: a passkey-themed call or text pushing you to a lookalike Microsoft 365 sign-in page to 'enable passkeys'. Here’s the nasty part: once someone signs in on that fake Microsoft 365 page, the attacker quietly registers their own authentication methods, then starts pulling data from SharePoint, OneDrive, and Exchange, way beyond just email. Your move: if someone asks for customer data or to 'verify passkeys' via email, call, or text, stop and use your normal route, our legal request process or your usual Microsoft 365 bookmark or app, never the link they send you.
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
Microsoft reports active intrusions where attackers trick employees with “passkey/SSO update” helpdesk pretexts delivered by phone, SMS, or even Microsoft Teams. Victims are sent to lookalike Microsoft sign-in pages or guided through device-code sign-in, letting attackers capture session access and…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
