Researchers reported real-world attacks against NGOs that started with a spear‑phishing email containing a link to a legitimate (but vulnerable) university website. Clicking the link redirected victims into a multi-step exploit chain that ultimately gave attackers full control of the victim’s computer and enabled follow-on spying and credential theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “University brief, please review.” Looks legit, link goes to a real .edu site. Safe, right? In real attacks, clicking that link hit a vulnerable university page with reflected XSS, then silently redirected into a “BlueMoon” Chrome and Windows zero‑day chain that took over the computer. Aha moment: the link itself looked fine. The giveaway was what happened after. The real university page flashed, then quickly bounced to another site and the browser behaved oddly. If you click a link and a real site instantly redirects or acts weird, stop using that browser, take a screenshot, and report it to Security right away.
China-linked actor UTA0565 sent phishing emails that pushed recipients to click spoofed links to fake media/NGO websites. Visiting the sites triggered a Chrome-to-Windows zero-day exploit chain that escaped the browser sandbox and installed CLEANGULP malware for remote control.
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
Researchers reported two China-linked groups targeting NGOs with spear-phishing that led victims through a legitimate U.S. university website before redirecting them to attacker infrastructure. The attackers used a chained Chrome/Windows exploit to take control, then deployed different payloads,…
China-linked attackers targeted NGOs with spear-phishing emails that urged recipients to click a link to a legitimate U.S. university website. The link path abused a website flaw to silently redirect victims to attacker infrastructure, which then exploited Chrome and Windows to install malware…
