After a Free Mobile customer data breach, scammers sent convincing emails that mimic Free Mobile’s real branding and templates. The emails claim a €9.99 unpaid invoice and threaten service suspension, pushing victims to a fake payment page that collects credit card details via redirect links.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from “Free Mobile”: pay a €9.99 invoice now or your service is suspended. It even uses Free’s real logo and template. But look at the sender: freemobile-regularisation@knowledgegrowthcenter.help. That is not Free Mobile. Click their link and you’re bounced through redirects to a lookalike site hosted behind Cloudflare, ending on a fake Free page asking for your credit card. If you get a surprise €9.99 invoice email, don’t click the link, open the Free Mobile app or go to mobile.free.fr or call 3244 and check your account there.
Malwarebytes reports that a multi-stage Windows malware loader called PavinLoader is being delivered through multiple real-world campaigns, including ClickFix “verification” pages and fake software downloads. Victims are tricked into running installers or scripts that use legitimate Windows tools…
Researchers found a new macOS infostealer, “ClickLock Stealer,” that uses ClickFix-style fake verification pages to trick people into running Terminal commands. After infection, it shows a realistic macOS password prompt and can effectively lock the Mac until the victim enters the correct password,…
China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…
Criminals used sponsored Google search results to promote a malicious ChatGPT “Custom GPT” called “Plus 5.6.” Victims were led to a fake Cloudflare CAPTCHA page that ultimately tricked them into downloading and running a remote access trojan (RAT). This is a realistic web-based lure that can be…
A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…
Attackers are using sponsored Google ads to route people to a malicious “custom GPT” that looks like ChatGPT, even while the user is logged in on the real ChatGPT domain. The fake GPT displays a convincing “service availability” message and pushes a link to a “backup domain” that ultimately…
