This weekly recap describes a task scam in which victims were paid to create fake sales and reviews, then told they had a “negative balance” and needed to deposit their own money to receive payment. One fraudster reportedly lost more than $4.8 million after proceeds from this scam were placed into compromised Ledger wallet addresses and later stolen.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A side gig pays you to post fake sales and reviews. Then the dashboard says 'negative balance.' To get paid, it says, you must deposit your own money. That's the trap: your earnings become a bill. The money trail got stranger: someone running this scam reportedly lost over $4.8 million when three Ledger addresses holding the proceeds were emptied. Remember the switch: if a job asks you to pay to get paid, stop.
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
Scammers are exploiting fear from a recent Ledger-related spyware incident by sending emails that push a fake “firmware update.” The email urges recipients to connect their hardware wallet and click through to a realistic-looking “Genuine check” page with an “Update Now” button, risking theft if…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
Attackers took over the verified official HBO Max Reddit account and used it to run a 48-hour wave of malicious ads. The ads sent people to lookalike download sites that tricked them into copying and running commands, leading to information-stealing malware on both macOS and Windows. Researchers…
A reported case involved a Virginia woman receiving hundreds of automated sign-up emails in a day. The flood was used to hide a legitimate bank alert about a fraudulent laptop purchase, showing how inbox overload can conceal account fraud or unauthorized transactions.
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
