The article describes real-world social engineering aimed at both consumers and financial firms, including phone-based attacks on hedge funds and a turnkey scam kit that impersonates Tesla to steal cryptocurrency. The kit uses a professional-looking fake presale website with urgency tactics (countdown timers and fake progress bars) to push victims into handing over their wallet recovery phrase or sending crypto directly to scammers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You see a slick Tesla crypto presale site, your X profile photo on it, countdown ticking down. Looks legit, right? Behind that page is a $500 turnkey scam kit, used to impersonate Tesla and push you into one of two things: typing your 12-word wallet recovery phrase, or sending crypto straight to their address. Here’s the catch: real investments never ask for a recovery phrase. That’s the master key. BioCatch says these impersonation scams have more than doubled, and scammers now buy pro-grade kits instead of making sloppy sites. If any “investment”, Tesla or otherwise, asks for your 12-word recovery phrase, stop. Close the site. Then report it to security.
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
An alleged North Korean operation called “WaterPlum” targeted job seekers by posing as AI and blockchain companies and using the interview process to trick applicants into downloading malicious files. Authorities say the campaign infected tens of thousands of devices worldwide and led to theft from…
