A malicious Google Ads campaign showed convincing “computer locked/infected” warnings to Windows and Mac users and pressured them to call fake tech-support numbers. The goal was to confuse people into paying for bogus support, sharing personal information, or allowing remote access, not to actually lock the computer or install malware.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You click a weather or maps link, and suddenly: “Security Alert: Your computer has been locked. Call Support now.” This is a Google Ads tech-support scam. The ad opens a page that grabs full screen, hides the address bar and cursor, blocks your shortcuts, and blasts a fake Microsoft or Apple-style lock message with a phone number. Here’s the trick: your computer is not actually locked. It’s just the browser. The scam page is stalling, playing sounds, and trapping the screen to panic you into calling so they can demand money, personal info, or remote access. If you ever see this kind of “locked PC” pop-up, do not call the number. Hit Escape to leave full-screen or force-quit the browser, then contact our IT helpdesk through the usual channel.
Microsoft disrupted “EvilTokens,” a subscription cybercrime service that stole Microsoft account access using device-code phishing and then used AI-style automation to rapidly mine victims’ inboxes for payment and org-chart details. The goal was to quickly craft believable payment-fraud messages…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Scammers are using realistic LinkedIn recruiter profiles and even verified company pages to post fake jobs that push people to off-platform sites or email addresses. The scams aim to take money (e.g., paid “resume help”) or collect sensitive personal data like driver’s licenses or Social Security…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
