Dutch police are investigating ShinyHunters after a phone-based social engineering incident helped attackers break into Odido, the Netherlands’ largest mobile provider. Investigators say the caller persuaded an employee to log into a spoofed website, which was then used to steal data on more than 6.2 million people. The article also links ShinyHunters to high-profile data theft and extortion activity, including claims of a breach of an FBI jobs portal.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Dutch police just released audio of a call where ShinyHunters talked an Odido employee into a fake login, and 6.2 million people’s data walked out the door. On the call, the caller sounds legit, then says, “Just log in here so we can fix it,” and gives a link. The employee types corporate credentials into a spoofed login page, and that’s all ShinyHunters needed. Here’s the trap: a real colleague will never cold-call you and demand you log in through their link. If the URL isn’t your normal company login, that “quick fix” can become a 6.2‑million‑record breach. If anyone on the phone ever tells you where to log in, hang up, go to our usual login or helpdesk site yourself, and verify it there.
Arctic Wolf reports a wave of phone-based social engineering where attackers pose as internal IT, guide executives through “routine” MFA/passkey setup, and then send a company-branded login link that steals Microsoft 365 credentials and session tokens. Once inside, attackers methodically inventory…
A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Mandiant and Google report that the financially motivated group BREEZE COMET compromised Brazilian organizations to enable fraudulent bank transfers. The actor used human manipulation (including fake IT support calls) and believable “tax/receipt” downloads hosted on trusted-looking government…
ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the…
