The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing dark web data-sale claims and hacktivist DDoS activity, but the most simulation-ready detail is the phishing-to-credential-theft workflow.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: subject line just says, “Receipt.” There’s an HTML file attached and it looks like a payment document. You open it, and a login page pops up asking for your bank or email ID and password to view the receipt. The moment you type them, those credentials are shot straight to a Telegram chat via an API. Same trick with “Voicemail” emails: you click a link, land on a login page, and your ID and password are quietly relayed to Telegram. The common pattern? Email about money, receipts, or voicemail that suddenly demands a login. Your move: if an email or HTML attachment sends you to a login page, stop. Don’t type anything, go to the site yourself from your browser and log in there instead.
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
Researchers report multiple real-world email phishing campaigns that used tax and government-benefit themes to trick people into downloading malware. The campaigns used a “crypter” service called Cruciferra to hide malicious files and help malware run while avoiding detection. Targets included…
A June 2026 financial-sector threat report describes real phishing emails that used business-looking themes (e.g., money transfers, receipts, voicemail) to push victims to malicious links or HTML attachments that mimic login pages. The report also highlights cases where stolen account information…
