A Russia-linked threat group compromised hotel WiFi captive portals to redirect guests to fake “verification” pages. Victims were pushed toward either copying commands into a terminal to install malware or entering Microsoft credentials on spoofed login pages that added an attacker-controlled device to their account.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re in a hotel, you join the WiFi… and the portal suddenly wants you to “run a command” to get online. This is a hijacked hotel WiFi portal. One path is a fake “click‑to‑fix” page telling you to paste that string into Terminal or PowerShell, behind the scenes, it installs malware. Another path: you’re redirected to a Microsoft‑lookalike login page saying you must sign in to use the Internet. It’s on a copycat domain, and after you sign in, it tells you to paste an “authentication URL” that secretly adds a new device to your Microsoft account. Here’s the move: on any hotel or public WiFi, if the portal ever tells you to run Terminal or PowerShell commands, or to sign in with Microsoft to get online, stop and call IT before you do anything.
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
