Revolut confirmed a breach after an attacker impersonated a government agency and sent fraudulent data requests from what appeared to be a legitimate government email domain. Employees processed the requests as normal legal-compliance work, leading to exposure of sensitive customer identity and account information for a limited number of customers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this lands in your inbox: “Request for information, legal compliance. Please provide the requested customer records.” And it’s from a real government email domain. That’s exactly how Revolut was tricked. An unauthorized third party used a legitimate government agency domain with valid technical authentication, so the emails passed all the usual checks and were treated as standard legal work. Employees fulfilled the requests and sent over names, addresses, dates of birth, phone numbers, emails, ID documents, even transaction history. All because the sender domain looked right and the process felt routine. Your move: if an email claims to be a government or legal data request, stop. Don’t reply. Independently verify it using a phone number or portal you already trust before sending a single record.
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
This weekly roundup includes real-world social engineering campaigns, including scammers mailing fake IRS letters to cryptocurrency holders and a phishing campaign impersonating Bank of America. The lures are designed to pressure victims into visiting a bogus compliance portal or installing remote…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
Revolut says a third party posing as a government agency tricked the company into disclosing some customers’ personal and financial data. The attacker used an email address on a legitimate government agency domain, causing the request to be treated as a real legal inquiry. Revolut says customer…
