The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be recreated for security awareness simulations.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: one click on a “new business contact” email, and your entire mailbox is wide open. That’s what hit IEH Corporation: a phishing email posing as a prospective business contact, leading to a fake Microsoft 365 login where the user typed their password, letting someone quietly read emails, purchase orders, even engineering files. Now add this twist: funds like Two Sigma and Point72 are getting phone calls where the voice sounds exactly like a senior leader, because it’s being mimicked, to pressure staff into granting access or sharing data. The voice sounds right, but the caller isn’t. Your move: if a new contact email or a phone request sends you to a login or asks for access, stop and use your own route, type our Microsoft 365 or SSO URL yourself or call back on a known number before you do anything.
Levi Strauss reported that an unauthorized party used social-engineering to compromise three employees’ company-issued computers and steal corporate data. Reporting tied the incident to a wider campaign where attackers impersonated IT help desks using spoofed phone numbers and fraudulent websites…
A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
