A real phishing campaign targeted Colombian organizations with Spanish-language messages posing as administrative or judicial correspondence. The emails used script attachments disguised as documents and pressured recipients to open them, ultimately delivering XWorm malware through hidden PowerShell and a reusable loader.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A judicial notice lands in your inbox: urgent attention required. It looks like official Colombian correspondence. But the attachment isn't a document: it's a .vbs or .js script, named to look like a legal notice. That's the trick: opening it runs code, not a document. Hidden PowerShell loads a .NET component that delivers XWorm, which can collect information and run commands. Unexpected court notice with a .vbs or .js attachment? Report the email without opening it.
Researchers report that the threat actor Silent Lynx ran multiple real-world spear‑phishing campaigns against government organizations across Central Asia and the wider CIS region. Victims were lured with official-looking documents (e.g., diplomatic letters, airspace applications, and oil refinery…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
A real, ongoing phishing campaign is tricking recipients into opening malicious archives that appear to contain harmless TrueType font files (.ttf) but actually hide a Lua-based loader. Once executed, the loader uses stealthy, mostly in-memory techniques to install remote access trojans and…
Researchers tracked Kazakhstan-nexus group UAT-6275 (TAG-193) targeting government organizations across Central Asia and the wider CIS using convincing decoy documents tied to diplomacy and energy. The campaigns used malicious files (macro-enabled Word docs, shortcuts, and a WinRAR exploit) to…
Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
