Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into opening a PDF and visiting a malicious website that drops a script and ultimately runs an EXE payload.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Invoice attached, please review and process.” Looks normal, right? The attached PDF says, “Click here to view the full document online.” Behind that click is BraZetsu, a Windows malware toolkit used to turn your computer into "access for sale" on underground markets. The phishing PDF sends you to a fake site that scans your environment, then, if you’re in the right region, drops a VBS script and finally an EXE payload. Here’s the tell: a so-called invoice PDF or SVG that doesn’t actually show the document, but pushes you to a website, which then tries to download a script, like .VBS, to "continue." That’s not how real invoices or Edge updates work. If a PDF or invoice email sends you to a site that wants you to download or run a script or EXE, stop. Don’t open it, report the email and the file to Security immediately.
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
