A malicious Google Ads campaign showed convincing “computer locked/infected” warnings to Windows and Mac users and pressured them to call fake tech-support numbers. The goal was to confuse people into paying for bogus support, sharing personal information, or allowing remote access, not to actually lock the computer or install malware.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You click a weather or maps link, and suddenly: “Security Alert: Your computer has been locked. Call Support now.” This is a Google Ads tech-support scam. The ad opens a page that grabs full screen, hides the address bar and cursor, blocks your shortcuts, and blasts a fake Microsoft or Apple-style lock message with a phone number. Here’s the trick: your computer is not actually locked. It’s just the browser. The scam page is stalling, playing sounds, and trapping the screen to panic you into calling so they can demand money, personal info, or remote access. If you ever see this kind of “locked PC” pop-up, do not call the number. Hit Escape to leave full-screen or force-quit the browser, then contact our IT helpdesk through the usual channel.
Microsoft disrupted “EvilTokens,” a subscription cybercrime service that stole Microsoft account access using device-code phishing and then used AI-style automation to rapidly mine victims’ inboxes for payment and org-chart details. The goal was to quickly craft believable payment-fraud messages…
A phishing campaign is using more than 300 look-alike banking domains to steal business banking and treasury login credentials. First-time visitors see a convincing bank login page, but anyone returning from the same IP address sees a fake “account suspended” notice, making the sites appear to have…
Threat actors sent fake invitations to an exclusive Anthropic AI preview to steal Google and Microsoft work credentials. The campaign abused trusted services, including GoTo Webinar and a URL shortener, then used CAPTCHA pages and convincing fake login screens to make detection harder. Employees…
GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
A tracked threat group (UAT-11985) sent tailored event-invitation lures to people tied to Taiwan research organizations, trying to trick them into “registering” through a fake Google Form flow. Victims who clicked a disguised link or scanned a tampered QR code were pushed to a convincing Google…
Researchers observed a surge in short "request for quotation" (RFQ) emails that look like routine business inquiries to sales and procurement teams. After the victim replies, attackers send a follow-up link disguised as project documents or a procurement portal that leads to a fake Microsoft…
