The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the need for stronger identity verification and user training against voice-based scams.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You check into a hotel, join the Wi‑Fi, and a page pops up: “Wi‑Fi access requires a quick update to continue.” Microsoft says the CaptiveCrunch campaign on hotel Wi‑Fi pushed fake updates, ClickFix “fixes,” and device-code phishing to quietly steal Microsoft 365 access and keep it. Same playbook on the phone: ShinyHunters bragged about a Microsoft Entra vishing campaign, someone calls, “Hi, this is support about your Entra account, approve this login now,” while a random Microsoft 365 prompt appears on your screen. Here’s the rule: if public Wi‑Fi or a caller tells you to install an update or approve a Microsoft login you didn’t start, stop and hang up or close it, then contact our IT team through our normal channels.
Researchers showed how a malicious web page could trick OpenAI’s Atlas AI-enabled browser into taking actions a user didn’t intend, like spamming WhatsApp contacts or modifying an Amazon account. The attacks used prompt-injection style instructions hidden in a seemingly legitimate “newsletter…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
A Russia-linked threat group compromised hotel WiFi captive portals to redirect guests to fake “verification” pages. Victims were pushed toward either copying commands into a terminal to install malware or entering Microsoft credentials on spoofed login pages that added an attacker-controlled…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
