A Register podcast transcript describes real-world activity linked to the ShinyHunters cyber extortion crew, including an FBI-related breach and subsequent arrests. It also notes the group’s reliance on social engineering phone calls where attackers impersonate locked-out contractors or employees to trigger password/MFA resets. These details can be used to build realistic security-awareness simulations focused on helpdesk identity verification and MFA reset abuse.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: an extortion crew hits FBI-related data… and their secret weapon is a phone call to the helpdesk. ShinyHunters are really good at the social engineering part. They call in with a script: 'Hi, this is Alex, I’m a contractor and I’m locked out. Can you reset my password or my MFA so I can get back in?' Here’s the trap: no hacking tools, just pressure. Unverified caller, urgent story, and they push for a password or MFA reset, one click that hands them the keys, and fuels their extortion business. Your move: treat every password or MFA reset as high‑risk. If someone calls locked out, stop and run the full verification or callback process, no exceptions, even for ‘contractors.’
Brinks Home says it is investigating a cybersecurity incident after the ShinyHunters group claimed it broke in by calling employees and tricking them into approving Microsoft Entra authentication actions. The attacker is threatening to publish data it claims to have stolen, including alleged…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
Google Threat Intelligence reports that extortion group UNC6671 (formerly branded “BlackFile”) is calling employees while posing as IT helpdesk staff and pushing “urgent security migrations.” Victims are lured to spoofed login pages to capture passwords and MFA tokens, enabling Microsoft 365/Okta…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
