Researchers say the Gigabud Android banking trojan now clones a victim’s real banking app into a hidden Android Work Profile, so fraud can happen in a separate space that may not trigger the same malware and fraud signals. Victims are tricked into installing what looks like legitimate apps (airline, tax, or government), after which the malware can capture credentials and hide on-device activity while transactions occur.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a message: “Required update – download the official tax authority app to complete verification.” Looks legit, logo and all. But it’s Gigabud with a tool called Vwork. Once you install it, on first launch it begs for Accessibility and overlay permissions, then silently clones your real banking app into a hidden Android Work Profile. Here’s the nasty part: they use fake login screens to grab your banking password, then a black screen overlay while they move money from that cloned app. To the bank, it looks like a clean, new device with no malware history. Your move: if any ‘government, airline, or tax’ app wants you to sideload an APK and turn on Accessibility or overlay on first launch, stop, delete it, and use the official app store instead.
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
This weekly threat bulletin includes real-world campaigns where attackers impersonate recruiters and use fake hiring steps to trick people into running malicious files. One campaign uses fake LinkedIn coding tests delivered via cloud links, and another uses fake job interviews with trojanized macOS…
Kaspersky reported that Iran-linked APT Mirage Kitten approached software engineers on LinkedIn using fake recruiter personas and sent “coding challenges” that were actually trojanized projects. The lure used legitimate-looking cloud hosting (Amazon S3) and even instructed victims not to use AI…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
