The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing dark web data-sale claims and hacktivist DDoS activity, but the most simulation-ready detail is the phishing-to-credential-theft workflow.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: subject line just says, “Receipt.” There’s an HTML file attached and it looks like a payment document. You open it, and a login page pops up asking for your bank or email ID and password to view the receipt. The moment you type them, those credentials are shot straight to a Telegram chat via an API. Same trick with “Voicemail” emails: you click a link, land on a login page, and your ID and password are quietly relayed to Telegram. The common pattern? Email about money, receipts, or voicemail that suddenly demands a login. Your move: if an email or HTML attachment sends you to a login page, stop. Don’t type anything, go to the site yourself from your browser and log in there instead.
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Mandiant and Google report that the financially motivated group BREEZE COMET compromised Brazilian organizations to enable fraudulent bank transfers. The actor used human manipulation (including fake IT support calls) and believable “tax/receipt” downloads hosted on trusted-looking government…
Researchers reported two China-aligned campaigns that used phishing and impersonation to target AI policy experts and multiple Asian government organizations. One campaign built rapport with “AI policy” themed outreach before sending links to a OneDrive credential-harvesting page, while another…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
