Researchers described two cybercrime operations. While one campaign focused on breaking into websites and infrastructure, a second operation (“Operation Master”) ran an automated invoice-fraud system that sent millions of messages with personalized invoice links designed to trick victims into paying via Brazil’s Pix system.
Researchers described an operation known as Operation Master, which ran an automated invoice-fraud platform. Rather than targeting a single organization, the platform generated over 2.4 million messages across email, SMS, and WhatsApp. Each message included one of over 622,666 personalized invoice links, designed to make the request look tailored to the recipient. The ultimate goal was to trick people into completing payments through Brazil's Pix instant payment system.
The campaign reached both individual consumers and corporations, showing that the platform was built to operate at scale across different audiences rather than focusing narrowly on one sector. Activity tied to this platform has been linked to an actor using the alias masterblack on cybercrime forums.
The scale and personalization of this campaign are what made it effective. Automating invoice generation and distribution across three channels, email, SMS, and WhatsApp, let the operators cast a wide net while still presenting each message as if it were specifically addressed to the recipient. Personalized invoice links can look legitimate at a glance, especially when they arrive through channels people already associate with routine notifications and receipts.
The reported interaction numbers illustrate the impact of this approach: out of the messages sent, the platform recorded 169,906 target interactions, with a cumulative invoice value across tracked short links reaching R$150.4 million.
Organizations should treat any unexpected invoice link, particularly one delivered through SMS or WhatsApp, as a prompt to verify through a separate, trusted channel before paying. Personalization alone should never be treated as proof of legitimacy, since automated platforms like this one can generate tailored-looking links at massive scale.
Finance, accounts payable, procurement, and billing teams benefit most from targeted training on invoice fraud patterns: unexpected invoices, link-based payment flows, and urgency-driven requests. Because this type of fraud also reaches general consumers, broader anti-phishing and messaging-safety awareness across all employees adds another layer of protection against campaigns built to exploit routine billing interactions.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Operation Master was an automated, multi-tenant invoice-fraud platform that generated over 2.4 million messages across email, SMS, and WhatsApp, aiming to trick victims into making Pix payments.
The campaign used email, SMS, and WhatsApp to deliver personalized invoice links, with over 622,666 of these links created to target Brazilian consumers and corporations.
Accounts payable, finance, procurement, and billing teams are key targets, but the campaign also reached general consumers, so any employee who handles payments should be cautious.
Warning signs include unexpected invoices sent via SMS or WhatsApp instead of normal billing channels, pressure to pay through a link rather than a known portal, and short or tracked URLs instead of a recognized vendor domain.
You get an SMS: “You have a pending invoice. Use the personalized invoice link to complete a Pix payment.” Looks legit, right? Behind that message could be Operation Master, an invoice-fraud engine that blasted 2.4 million emails, SMS, and WhatsApp messages with 622,000 personalized Pix invoice links, all designed to drain real money. Here’s the trap: the invoice page is personalized, professional, and pushes you to pay via Pix using that link. But the URL is a short or unknown domain, and the invoice came by SMS or WhatsApp instead of your normal billing channel. If you get an invoice link like this, stop. Don’t pay from the message. Open your usual billing portal or call the vendor using a known number and confirm it first.
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
A threat landscape report describes how criminals now buy or rent phishing, fraud, malware, and hidden infrastructure “as a service,” making scams faster to launch and harder to stop. The article highlights practical, repeatable social-engineering workflows such as fake CAPTCHA pages that trick…
