Researchers reported real-world attacks against NGOs that started with a spear‑phishing email containing a link to a legitimate (but vulnerable) university website. Clicking the link redirected victims into a multi-step exploit chain that ultimately gave attackers full control of the victim’s computer and enabled follow-on spying and credential theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “University brief, please review.” Looks legit, link goes to a real .edu site. Safe, right? In real attacks, clicking that link hit a vulnerable university page with reflected XSS, then silently redirected into a “BlueMoon” Chrome and Windows zero‑day chain that took over the computer. Aha moment: the link itself looked fine. The giveaway was what happened after. The real university page flashed, then quickly bounced to another site and the browser behaved oddly. If you click a link and a real site instantly redirects or acts weird, stop using that browser, take a screenshot, and report it to Security right away.
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
Researchers reported two China-linked groups targeting NGOs with spear-phishing that led victims through a legitimate U.S. university website before redirecting them to attacker infrastructure. The attackers used a chained Chrome/Windows exploit to take control, then deployed different payloads,…
China-linked attackers targeted NGOs with spear-phishing emails that urged recipients to click a link to a legitimate U.S. university website. The link path abused a website flaw to silently redirect victims to attacker infrastructure, which then exploited Chrome and Windows to install malware…
Researchers reported four separate espionage groups using the same “BlueMoon” exploit kit within days, targeting organizations in the US and Southeast Asia. The attacks began with phishing emails that lured recipients to attacker-controlled websites, where Chrome and Windows vulnerabilities were…
Multiple suspected China-linked espionage groups used a new exploit kit (“BlueMoon”) that starts with phishing emails and a malicious link to break into organizations in the US and Southeast Asia. Clicking the link can trigger browser and Windows vulnerabilities to install surveillance tools,…
Multiple real-world intrusions used a ClickFix-style lure where victims visiting compromised websites saw fake CAPTCHA prompts and were tricked into running a command themselves. Separately, attackers also abused the legitimate, signed Node.js runtime (node.exe) to run malicious JavaScript while…
