Researchers describe a real phishing operation that tricks people into installing legitimate remote monitoring and management (RMM) tools so attackers can remotely control devices. The campaign uses familiar-looking documents (tax forms, UPS/shipping notices, Adobe PDFs, invoices, and Social Security themes) and rapidly rotates its hosting infrastructure daily to evade detection.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Action required: tax document available for download.” Looks like CRA, UPS, or Social Security. You click. The link opens a fake document page that looks like Adobe or UPS, but the download is a ZIP file that quietly installs real remote monitoring software, RMM, so someone can control your machine. Here’s the twist: this campaign hits 46 countries and rotates websites daily, so the URL might look new or harmless. The real red flag is the behavior: an “official” tax or UPS email that makes you download and run a ZIP or installer just to see a form. If any “official document” email wants you to download a ZIP or install anything, stop. Don’t open it, forward it to the security team and confirm through the real CRA, UPS, or agency site instead.
Researchers found a DocuSign lookalike phishing workflow that guides people through a realistic “document viewing” experience and then convinces them to download legitimate remote access tools. Instead of classic malware, the attackers install trusted IT administration software (RMM) to keep…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
A real multi-stage phishing campaign abused trusted cloud platforms (notably Cloudflare Workers) to make fake login flows look legitimate and to bypass MFA. The attack chained a phishing email, a fake CAPTCHA page on a compromised site, and a browser “pop-up” spoof that captured both credentials…
Researchers observed insurance-themed phishing that doesn’t just steal passwords, it hijacks accounts in real time while the victim is actively logging in. The attack often starts with sponsored Google ads that lead to convincing fake insurance portals, which immediately prompt victims for one-time…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers describe an active campaign ("SMOKE#SCREEN") where attackers trick users with realistic software update and document-themed lures to install a legitimate remote-control tool (ScreenConnect). Once installed, the attacker gains persistent remote access that can look like normal IT…
