Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into money.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Holiday rush. A text says: ‘Verify your gift-card access now.’ An email may say: ‘Action required: Verify your holiday gift-card administration account.’ The link opens an unfamiliar sign-in page. Enter your work credentials, and Jingle Thief has a way in. Here’s the catch: they don’t need your gift-card balance. They need your login. From there, they can reach cloud systems and issue unauthorized gift cards at scale. Unexpected holiday verification request? Don’t use its link. Confirm it with your gift-card administrator through your approved internal contact.
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
MS-ISAC tracked attackers who used a phished K-12 staff account to send phishing messages to that employee’s contacts, including staff at other school districts. Because the messages came from legitimate, authenticated accounts, they could bypass normal email filters and help attackers move from…
Attackers are actively using fake human-verification prompts to persuade people to run commands through a legitimate, digitally signed Siemens application. The broader report also says SafePay ransomware operators gain access through phishing and stolen credentials, then target recovery data and…
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer…
INTERPOL’s Operation Serengeti III led to 1,462 arrests across 21 countries and disrupted fraud, ransomware, business email compromise and other cybercrime operations. One major case involved rotating call centers that used scripted investment pitches, fake trading platforms and fraudulent websites…
