CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers abused Microsoft’s device-code login flow to trick users into authorizing access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a fake IT call and one weird Microsoft code, and your SSO is gone in under five minutes. CrowdStrike saw vishing jump 134%, groups like CORDIAL SPIDER and SNARKY SPIDER call saying, “Hi, this is IT support,” then walk you to a fake login or Quick Assist so they can hijack your single sign-on. The new twist is device-code phishing: an email says, “Microsoft sign-in required: use this device code,” and you’re sent to a real microsoft.com page, so when you enter the code, you’re actually approving their login, not yours. Your move: if you didn’t start the login or support request, hang up, close it, and contact IT using our official helpdesk or chat, never the number or link they just gave you.
Microsoft reports a real-world campaign where attackers call or text employees’ personal phones while posing as internal IT. Victims are pushed to “update” passkeys/MFA/SSO and click a link to a fake Microsoft sign-in page, letting attackers get into Microsoft 365 and quietly pull email and files…
Uber Freight is investigating unauthorized access after the Helix extortion group claimed it stole nearly one million files from company cloud and email repositories. Google-linked research says the broader cluster (UNC6671) commonly gets in by calling employees and posing as IT helpdesk staff…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
CrowdStrike’s threat hunting report says attackers are increasingly using phone-based impersonation and trusted login flows to break into cloud email and SaaS quickly. The report highlights vishing callers posing as IT support, pushing employees to sign in via attacker-controlled phishing pages,…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
UNC6671 is running real-world voice phishing (vishing) campaigns where callers impersonate IT help desk staff and create urgency around “mandatory” security changes. Victims are pushed to spoofed login pages that capture passwords and MFA codes, enabling attackers to access and steal data from SaaS…
