The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real brands to steal payment details, showing how attackers use trusted brands and realistic storefronts to trick people into unsafe clicks and purchases.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a real Trezor newsletter in your inbox… and it’s actually a phishing email. Attackers hijacked Trezor’s Brevo account and blasted 347,000 customers. In 20 minutes, 2,500 people clicked a fake security link, because it came from a channel they trusted. Same trick with ads: a verified HBO Max Reddit ad pushes you to a fake site using ClickFix steps, 'paste this command to fix it', and that’s how the malware lands. Aha moment: if a “trusted” email or ad ever tells you to click a link or paste commands, stop. Your move: close it and go to the official site or app yourself to check.
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an…
The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
