A new Android malware family called “Manic” is being used in real campaigns targeting banking, government identity, and messaging apps, especially in Ukraine and parts of Europe. It spreads through phishing sites and “dropper” apps disguised as legitimate utilities (including a booking-app lure), then steals sensitive data like passwords and one-time codes and can even relay stolen data through nearby infected phones to reach the attacker.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On your Android phone, a site pops up: “Your phone needs a critical utility update. Download the updater now.” Looks urgent, looks legit. This is how the Manic spyware spreads: phishing sites and dropper apps posing as utilities or even a booking app to ‘confirm your reservation.’ You tap install, and it abuses Accessibility and notification permissions to grab passwords, one‑time codes, even lock‑screen secrets. Here’s the wild part: even if that phone goes offline, Manic can use Wi‑Fi Direct or Bluetooth to hop your data through nearby infected phones, up to four relay hops, until one has internet and ships out your banking and ID info. If any website tells you to download an Android app or update as an APK, stop. Close the tab, and only install apps from the official store or our approved internal catalog.
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
Researchers observed insurance-themed phishing that doesn’t just steal passwords, it hijacks accounts in real time while the victim is actively logging in. The attack often starts with sponsored Google ads that lead to convincing fake insurance portals, which immediately prompt victims for one-time…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
Researchers documented a real phishing method where attackers push fake bank sites up in search results, then show different content depending on how a person arrived. If someone clicks from a poisoned search result, the site shows a realistic bank login page to steal credentials; if security teams…
