A weekly threat roundup includes multiple real-world social engineering campaigns, including a phishing operation that abuses legitimate Power BI domains to look trustworthy and trick users into downloading a remote-access tool installer. It also describes a WhatsApp-delivered lure that tricks recipients into running a fake financial document executable, kicking off a multi-stage Windows infection chain.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email that looks like Microsoft Power BI sharing a report, big blue button saying, “Download Reference.” Looks totally legit, right? Behind that button, attackers abused real Power BI domains. You click, see a fake reference page, then a new tab quietly opens, fingerprints your machine, and pushes a ScreenConnect installer instead of any document. Same play on WhatsApp: a contact drops a so-called financial document named “Statement.exe.” A real statement is a PDF or spreadsheet, not an .exe that kicks off a multi-stage Windows infection and a remote access trojan. Here’s the move: if a “document” flow suddenly wants you to install software or run an .exe, stop. Don’t click it, send it to IT and ask, “Is this safe to run?”
UK and allied agencies warn that a Tehran-backed operation is targeting dissidents, activists, and journalists using social engineering to trick them into installing spyware called “Chosen Brick.” Attackers build trust on social media by impersonating known contacts or “technical support,” then…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
A real phishing campaign is targeting DEF CON speakers and attendees through X/Twitter messages pretending to be a Coindesk executive. Victims are sent to a Google document that attempts a “click-fix” trick to get them to paste malicious commands into a terminal or download malware. The goal is to…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
