Researchers describe a real phishing operation that tricks people into installing legitimate remote monitoring and management (RMM) tools so attackers can remotely control devices. The campaign uses familiar-looking documents (tax forms, UPS/shipping notices, Adobe PDFs, invoices, and Social Security themes) and rapidly rotates its hosting infrastructure daily to evade detection.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Action required: tax document available for download.” Looks like CRA, UPS, or Social Security. You click. The link opens a fake document page that looks like Adobe or UPS, but the download is a ZIP file that quietly installs real remote monitoring software, RMM, so someone can control your machine. Here’s the twist: this campaign hits 46 countries and rotates websites daily, so the URL might look new or harmless. The real red flag is the behavior: an “official” tax or UPS email that makes you download and run a ZIP or installer just to see a form. If any “official document” email wants you to download a ZIP or install anything, stop. Don’t open it, forward it to the security team and confirm through the real CRA, UPS, or agency site instead.
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Researchers found a DocuSign lookalike phishing workflow that guides people through a realistic “document viewing” experience and then convinces them to download legitimate remote access tools. Instead of classic malware, the attackers install trusted IT administration software (RMM) to keep…
A phishing kit dubbed N0va is targeting organizations in North America and Europe by impersonating familiar business services (like Microsoft Teams/SharePoint and DocuSign) and pushing victims through legitimate sign-in flows. By capturing authentication tokens rather than dropping obvious malware,…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
A real multi-stage phishing campaign abused trusted cloud platforms (notably Cloudflare Workers) to make fake login flows look legitimate and to bypass MFA. The attack chained a phishing email, a fake CAPTCHA page on a compromised site, and a browser “pop-up” spoof that captured both credentials…
Researchers observed insurance-themed phishing that doesn’t just steal passwords, it hijacks accounts in real time while the victim is actively logging in. The attack often starts with sponsored Google ads that lead to convincing fake insurance portals, which immediately prompt victims for one-time…
