The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real brands to steal payment details, showing how attackers use trusted brands and realistic storefronts to trick people into unsafe clicks and purchases.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a real Trezor newsletter in your inbox… and it’s actually a phishing email. Attackers hijacked Trezor’s Brevo account and blasted 347,000 customers. In 20 minutes, 2,500 people clicked a fake security link, because it came from a channel they trusted. Same trick with ads: a verified HBO Max Reddit ad pushes you to a fake site using ClickFix steps, 'paste this command to fix it', and that’s how the malware lands. Aha moment: if a “trusted” email or ad ever tells you to click a link or paste commands, stop. Your move: close it and go to the official site or app yourself to check.
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
