A financially motivated actor (“Doubloon Dredger”) abused legitimate Notion sharing notifications to trick employees into opening a PDF and completing a Microsoft device-code login flow. This allowed the attacker to harvest authentication tokens and access victim accounts without needing the password. Researchers also observed layered phishing infrastructure and links to phishing-as-a-service platforms like EvilTokens and Tycoon2FA.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a Notion email: your CFO just shared a document you need to review and sign. Looks totally legit, right? But this Doubloon Dredger scam chains three steps: Notion alert, then a PDF with a big 'Review and Sign' button, then an Adobe-looking page that hands you a Microsoft device code. Here’s the twist: they tell you, 'Enter this code on Microsoft’s device-code page.' The Microsoft site is real, but entering that code hands EvilTokens and Tycoon2FA a token to your account, no password needed. If a document you weren’t expecting leads to a PDF and then tells you to enter a code on Microsoft, stop. Message the executive directly on Teams or email and confirm before you touch any code.
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
The FBI warns of an ongoing social-engineering campaign targeting high-profile individuals and their contacts through a commercial messaging app. Attackers impersonate trusted people (e.g., government officials, journalists) and send links that trick victims into approving OAuth access to a…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
This report describes real-world social engineering where victims are tricked into copying and pasting commands that install malware on macOS and Windows. It also highlights device code phishing activity targeting Microsoft Entra ID/Microsoft 365 tokens, enabling attackers to access accounts and…
Google says three suspected Russian espionage clusters are targeting academics, think tanks, diplomats, and related nonprofit staff by abusing legitimate login and verification workflows that may not look like “classic phishing.” The campaigns include app-password scams, OAuth/device-code tricks,…
Criminals using the “Greatness” phishing-as-a-service kit are running real-world phishing campaigns that trick employees into approving a Microsoft device-code login flow, allowing attackers to bypass MFA and steal access tokens. Recent activity includes RingCentral “voicemail” lures and multi-step…
