A security assessment found that a single crafted link could run attacker-controlled JavaScript in the browser of a logged-in Siemens Teamcenter user (CVE-2026-58113). Because Teamcenter’s login redirect page auto-submits a form on load, simply opening the link (e.g., from a phishing email or chat) can trigger code execution without any additional clicks. The researchers demonstrated real impact by silently changing workflow delegation (surrogate) settings via Teamcenter’s API using the victim’s authenticated session.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: "Subject: Teamcenter SSO Redirect Required, Please Sign In." Looks routine, right? But this one crafted Teamcenter login-redirect link hides a reflected XSS bug, opening it is enough to run someone else’s JavaScript in your logged-in browser. Because that page auto-submits a form, you never click anything, yet the attacker’s code can quietly call Teamcenter’s setSurrogate API and assign a delegate who can act as you in workflows. If you see an unexpected Teamcenter SSO or login-redirect link, don’t click it, close the message and open Teamcenter from your normal bookmark instead.
Microsoft reported a campaign where attackers abused hotel Wi‑Fi captive portals to manipulate DNS/HTTP traffic and redirect people to attacker-controlled phishing pages. Victims were tricked into installing malware disguised as browser/operating system updates, and some pages redirected users into…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
Attackers broke into Brevo, the email platform Trezor uses for newsletters, and sent a phishing “security warning” from Trezor’s real mailing system. The email claimed a serious hardware issue could expose wallet recovery seeds and pushed people to a malicious site/app that asked for a wallet…
Multiple suspected China-linked espionage groups used a new exploit kit (“BlueMoon”) that starts with phishing emails and a malicious link to break into organizations in the US and Southeast Asia. Clicking the link can trigger browser and Windows vulnerabilities to install surveillance tools,…
Levi Strauss disclosed a breach after attackers used social engineering to access three employees’ work computers and steal some corporate data. Separately, reporting and Google’s tracking describe a broader campaign where criminals call employees while posing as coworkers or IT, then send them to…
IEH Corporation disclosed that a phishing email tricked an employee into entering Microsoft 365 credentials on a fake login page, giving an attacker access to the employee’s mailbox. The compromised inbox contained emails and attachments including engineering documents and potentially…
