Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business hours and often used malicious attachments and mismatched reply-to addresses to capture responses.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email at 2pm on Monday: subject line, “Document attached (please review)”, and it’s from your own company domain. But this could be a Microsoft 365 “Direct Send” phish. KnowBe4 saw nearly 29,800 of these in two months, many timed to feel human-sent, with about a third carrying malicious attachments. Here’s the trick: the email looks internal, but the Reply-To quietly points to an external address, and the attachment is unexpected. Internal-looking does not mean safe. If an “internal” email has an unexpected attachment or odd Reply-To, stop. Don’t open it, forward it to the security team and ask if it’s legit.
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
A Russia-linked threat group compromised hotel WiFi captive portals to redirect guests to fake “verification” pages. Victims were pushed toward either copying commands into a terminal to install malware or entering Microsoft credentials on spoofed login pages that added an attacker-controlled…
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
