Attackers hijacked two official Irish police X/Twitter accounts and used the trusted accounts to promote a fake cryptocurrency airdrop. The posts directed followers to a link that could trick them into giving up cryptocurrency-wallet keys, allowing criminals to drain their funds.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Free crypto from an Irish police account? That actually appeared on X. Someone got into the official @GardaTraffic and @GardaInfo accounts. Their posts said followers could claim an airdrop, then sent them to a link asking for wallet keys. Here's the giveaway: @GardaTraffic normally posts road-safety updates, not crypto deals. Even an official account can be hijacked. Wallet keys give access to your funds. One rule: never enter your wallet keys to claim an airdrop.
Users reported getting repeated, unsolicited password-reset emails from X after the launch of X Money. The emails appear legitimate, but attackers may be using them to confuse users and then send follow-up phishing messages that lead to fake X login pages to steal credentials. There is no confirmed…
A phishing campaign targets YouTube creators with a fake, invite-only Amazon Music advertising deal. The fraudulent site uses each creator’s real public channel statistics to appear legitimate, then places a fake Google sign-in screen over the page to capture Google passwords and multi-factor…
A recent scam targets YouTube creators with personalized “paid collaboration” emails that impersonate well-known brands and push victims to a fake collaboration platform. The site then routes victims to a Google sign-in step that can capture credentials or trick users into granting dangerous…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
