Researchers demonstrated an attack chain against TP-Link Omada where attackers can claim a device in the cloud using guessed serial numbers and default factory credentials. The attacker can then inject a fake “session expired” login prompt into the admin’s browser to steal the cloud controller password and potentially create a VPN tunnel into the victim’s internal network. The issues affect Omada and also extend to other TP-Link product families that share the same certificate trust chain.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re in the TP‑Link Omada dashboard, configuring a site, when a “session expired” login box suddenly pops up over the screen. Researchers showed they can claim Omada devices in the cloud, inject JavaScript into a firmware field, and use it to draw this fake session-expired box that sends your password to their server. Here’s the trick: the fake box looks legit and sits right on top of your live dashboard. But Omada normally logs you out with a full-page redirect to the real login screen, not a little pop-up floating over active graphs and devices. If Omada asks you to log in again, don’t trust the pop-up. Close it, go to your normal Omada login URL in a fresh tab, and sign in only there.
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
A real “fake recruiter” phishing campaign (tracked as RecruitTrap) is targeting employees’ corporate credentials, especially on mobile devices. The scam uses lookalike recruitment domains and full-screen fake login pages that hide browser cues, and it rejects personal email addresses to focus on…
ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the…
ReliaQuest disclosed a real social engineering incident where attackers registered a lookalike domain, hosted a fake ReliaQuest SSO page, and called employees while impersonating a named security employee. One employee entered credentials and approved an MFA push, briefly giving the attacker…
ReliaQuest said it was targeted in a ShinyHunters-linked social engineering attack that used a fake domain hosting a ReliaQuest single sign-on (SSO) phishing page. Attackers then called employees while impersonating named security staff to push victims to the fake login page, resulting in one…
Researchers found a large recruitment-themed phishing campaign where victims receive unsolicited interview invites and are sent to fake scheduling or recruitment pages. The pages use “Browser-in-the-Browser” fake login popups to steal Google/Facebook passwords and, in some cases, capture MFA codes…
