Attackers are abusing legitimate services such as Dell and Staples to send real, authenticated emails containing fraudulent support phone numbers. The emails pass normal authentication checks because the trusted platform sends them, but the attacker controls fields displayed in the message and uses them to lure recipients into calling a scam helpline. Cisco Talos also observed similar abuse through registration emails and bounced-email notices carrying file-sharing lures.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A Dell receipt says you bought Microsoft Project for $736.09. You didn’t. Here’s the twist: Dell really sent the email. Its template and authentication checks are genuine. But someone put ‘Helpline’ and a phone number in the ‘Ship To’ field. That’s the callback trap: the unexpected charge makes you call the number in the receipt. Staples orders have carried fake numbers too. A real email can still contain someone else’s instructions. If the purchase isn’t yours, don’t call the receipt’s helpline. Open Dell’s website yourself and check your orders there.
Attackers abused legitimate Staples and Dell order-notification systems to send convincing emails about expensive purchases the recipient never made. Instead of using a suspicious link, the messages inserted attacker-controlled “helpline” numbers into trusted transaction fields, aiming to move…
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
Cofense analyzed real phishing emails disguised as bidding invitations. The emails send recipients to fake, branded login and device-enrollment pages, then trick them into entering a device code in a genuine Microsoft prompt. Doing so can authorize an attacker’s session without giving them the…
A scammer used a hacked Facebook Marketplace account to pose as a seller and direct a buyer to send $1,000 to a Cash App account supposedly belonging to the seller’s wife. The payment account had been opened using another person’s stolen identity, illustrating how account impersonation and identity…
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
Cisco Talos reports a remote access trojan (msaRAT) linked to the Chaos ransomware group that hides its command-and-control traffic inside legitimate Chrome/Edge browser activity. The malware is delivered as a fake “Windows update” MSI and, once run, launches a browser in a special debug mode to…
