CrowdStrike reports multiple real-world campaigns where attackers used human manipulation to break into organizations, including LinkedIn outreach that led to a malicious link click and phone-based scams that pushed victims to fake sign-in pages. The report also describes attackers abusing stolen or compromised identities to rapidly gain access to cloud and AI services, then moving quickly to data theft or large-scale API abuse.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
LinkedIn message: “Can you jump on a quick video call to discuss something?” That invite might be the entire breach. CrowdStrike saw this play out at Mastra: a “recruiter” meets an employee on LinkedIn, jumps to video, then drops a link in chat. One click, and a malicious npm dependency was injected into 131 Mastra AI framework packages. Same playbook with vishing: a call says, “Please open this sign-in page on your personal mobile device to fix the issue.” Targets are steered to a spoofed single sign-on page, and Snarky Spider went from account takeover to data theft in under five minutes. Your move: if someone on LinkedIn or a caller tells you to click a link or log in to “fix” something, hang up, close the call, and go to our official login or help portal yourself, then report it.
Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…
Researchers say a phishing-as-a-service platform called AnonyMousKIT targets people who recently lost or had an iPhone stolen by pretending to be “Apple Support.” The operation uses email/SMS/WhatsApp and AI-assisted voice calls to convince victims to share their iPhone passcode and follow a…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Microsoft says attackers have been compromising Microsoft 365 cloud accounts by posing as internal IT staff and pressuring employees to “update” passkeys or sign-in settings. Victims are directed to lookalike sign-in pages or tricked into authorizing attacker access via device-code sign-in, after…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
