Researchers demonstrated an attack chain against TP-Link Omada where attackers can claim a device in the cloud using guessed serial numbers and default factory credentials. The attacker can then inject a fake “session expired” login prompt into the admin’s browser to steal the cloud controller password and potentially create a VPN tunnel into the victim’s internal network. The issues affect Omada and also extend to other TP-Link product families that share the same certificate trust chain.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re in the TP‑Link Omada dashboard, configuring a site, when a “session expired” login box suddenly pops up over the screen. Researchers showed they can claim Omada devices in the cloud, inject JavaScript into a firmware field, and use it to draw this fake session-expired box that sends your password to their server. Here’s the trick: the fake box looks legit and sits right on top of your live dashboard. But Omada normally logs you out with a full-page redirect to the real login screen, not a little pop-up floating over active graphs and devices. If Omada asks you to log in again, don’t trust the pop-up. Close it, go to your normal Omada login URL in a fresh tab, and sign in only there.
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
Criminal groups are stealing Meta Business Manager and Google Ads accounts using phishing that arrives through trusted platforms like Salesforce, Google Workspace mail-merge, and SharePoint links. The stolen accounts are valuable not just for the budget inside them, but because older accounts with…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Zenity Labs described a real phishing-based technique (“AgentForger”) that could silently create an autonomous AI agent inside an OpenAI workspace after a single click. The planted agent can keep running on a schedule, read and act across connected tools like Outlook/Slack/Drive, and execute new…
Cofense observed a real phishing campaign impersonating Google Ads Sync Accounts (MMC) with a fake “maintenance/system upgrade” notice. The email pressures recipients to click “Complete Sync Account,” sending them through lookalike sites and a fake Google sign-in pop-up that captures credentials.…
PortSwigger research shows how attackers can weaponize HTML/CSS inside emails to cross trust boundaries in webmail, including UI manipulation, token theft, and password theft. The paper highlights real-world weaknesses in email sanitization and gives concrete examples (including an Outlook…
