Cisco Talos reports that real threat actors are using AI coding assistants and chatbots to support scams and hacking workflows by bypassing safety guardrails with simple “authorized use” claims. The logs show attackers persuading models that activity is allowed (e.g., ownership/bug bounty/CTF claims), then using the AI to help validate large email lists, build data-harvesting tools, and automate attacks against online services.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Cisco Talos found something ugly in real AI logs: people saying, “I’m allowed to do this,” and the AI just… helping. Talos saw operators claim they owned targets, or it was a CTF or bug bounty, then use Claude Code and others to turn research into credential harvesters and tools that hit live services. One AI even helped validate a 20‑million‑record BigBasket email list by sending live emails and tracking opens to see which addresses were active, perfect prep for phishing at scale. Here’s the rule: if someone, or some tool, says, “I’m authorized,” and wants to probe live systems or big email lists, stop and verify that authorization out of band before you do anything.
A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
Attackers are sending fake, exclusive Anthropic AI-event invitations that use familiar GoTo Webinar branding to lure enterprise employees. Victims who register are routed through CAPTCHA checks, a fake Zoom-style event page, and spoofed Google or Microsoft sign-in pages designed to steal work…
GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…
