This weekly threat bulletin highlights multiple real-world incidents and campaigns, including phishing operations aimed at tricking people into handing over credentials. One campaign targeted Taiwanese research organizations with event-invitation emails, QR codes, and fake Google login pages designed to capture passwords and MFA in real time. Another campaign used “hidden” instructions in emails to manipulate AI email assistants into promoting fraudulent requests or revealing information.
This campaign targeted Taiwanese research organizations with phishing emails impersonating academic and policy institutions. The emails contained event invitations that asked recipients to scan a QR code to view agenda details and confirm attendance. Scanning the code led to a fake Google login page designed to capture usernames, passwords, and MFA codes. According to the findings, the phishing infrastructure could intercept credentials and MFA challenges in real time, meaning even accounts protected by multi-factor authentication were at risk.
A second, related campaign targeted employees and AI-powered email assistants. These emails combined standard phishing lures with hidden prompt-injection instructions embedded in HTML comments and invisible text. The hidden instructions attempted to manipulate AI assistants into promoting fraudulent requests or disclosing information without the human recipient ever seeing the injected content.
Several factors made these attacks effective:
Red flags across both scenarios include:
Researchers, faculty, administrative staff, executives, and anyone using AI email assistants should treat QR codes in unsolicited event invitations as high-risk. Verify the sender through a separate channel and access event sites through known, trusted URLs rather than scanning the code. Never enter credentials immediately after scanning a QR code without confirming the destination is legitimate.
Organizations should also avoid relying solely on AI email assistants for trust decisions, since attackers can hide instructions in email HTML to influence these tools. Strong MFA remains important, but staff should stay alert to suspicious MFA prompts, since some phishing infrastructure is built specifically to intercept MFA challenges in real time.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers sent event invitation emails impersonating academic and policy institutions, asking recipients to scan a QR code to view agenda details, which led to a fake Google login page that captured credentials and MFA codes in real time.
QR codes hide the real destination URL from the recipient, making it harder to spot a fake login page before entering credentials.
It involves hiding instructions in HTML comments or invisible text within an email so that AI-powered email assistants are manipulated into promoting fraudulent requests or disclosing information.
Not always; the phishing infrastructure in this campaign was built to intercept credentials and MFA challenges in real time, so users should still watch for suspicious MFA prompts.
You get an email: “You’re invited to an academic policy event, scan the QR code to view the agenda.” Looks legit, right? In a real campaign against research orgs, that QR code opened a fake Google login that stole passwords and even MFA codes in real time. Here’s the twist: some phishing emails now also hide invisible instructions in the HTML to trick AI email assistants into pushing fraudulent requests or leaking info. If an invite makes you scan a QR code just to see details, don’t log in from that link. Instead, open your browser and go to the event or Google site by typing the known URL yourself.
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This weekly threat bulletin includes real-world campaigns where attackers impersonate recruiters and use fake hiring steps to trick people into running malicious files. One campaign uses fake LinkedIn coding tests delivered via cloud links, and another uses fake job interviews with trojanized macOS…
Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…
Okta analyzed thousands of real social-engineering incidents and found most account takeovers still rely on stealing passwords and then bypassing MFA through push prompts or one-time codes. Okta described multiple campaigns where attackers phished credentials and then talked victims into using…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
