Researchers demonstrated an attack chain against TP-Link Omada where attackers can claim a device in the cloud using guessed serial numbers and default factory credentials. The attacker can then inject a fake “session expired” login prompt into the admin’s browser to steal the cloud controller password and potentially create a VPN tunnel into the victim’s internal network. The issues affect Omada and also extend to other TP-Link product families that share the same certificate trust chain.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re in the TP‑Link Omada dashboard, configuring a site, when a “session expired” login box suddenly pops up over the screen. Researchers showed they can claim Omada devices in the cloud, inject JavaScript into a firmware field, and use it to draw this fake session-expired box that sends your password to their server. Here’s the trick: the fake box looks legit and sits right on top of your live dashboard. But Omada normally logs you out with a full-page redirect to the real login screen, not a little pop-up floating over active graphs and devices. If Omada asks you to log in again, don’t trust the pop-up. Close it, go to your normal Omada login URL in a fresh tab, and sign in only there.
Researchers describe RatHat, an Android trojan linked to China-based operators, that spreads via smishing, malvertising, and fake app stores to trick people into installing a malicious APK. Once installed, it pushes for Accessibility permissions and then uses that access to take deep control of the…
Attackers are sending fake ChatGPT billing emails that pressure people to “update payment” within 48 hours to avoid service interruption. The message links to a convincing look‑alike ChatGPT login page via a Google redirect, aiming to steal OpenAI credentials.
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
Arctic Wolf reports a wave of phone-based social engineering where attackers pose as internal IT, guide executives through “routine” MFA/passkey setup, and then send a company-branded login link that steals Microsoft 365 credentials and session tokens. Once inside, attackers methodically inventory…
Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to…
Microsoft researchers reported a real, high-volume phishing campaign that used invisible Unicode “tag” characters to break up finance-related lure words (like “funding”) so email filters wouldn’t detect them. The emails looked normal to recipients but contained hidden characters in the underlying…
