CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers abused Microsoft’s device-code login flow to trick users into authorizing access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a fake IT call and one weird Microsoft code, and your SSO is gone in under five minutes. CrowdStrike saw vishing jump 134%, groups like CORDIAL SPIDER and SNARKY SPIDER call saying, “Hi, this is IT support,” then walk you to a fake login or Quick Assist so they can hijack your single sign-on. The new twist is device-code phishing: an email says, “Microsoft sign-in required: use this device code,” and you’re sent to a real microsoft.com page, so when you enter the code, you’re actually approving their login, not yours. Your move: if you didn’t start the login or support request, hang up, close it, and contact IT using our official helpdesk or chat, never the number or link they just gave you.
CrowdStrike’s threat hunting report says attackers are increasingly using phone-based impersonation and trusted login flows to break into cloud email and SaaS quickly. The report highlights vishing callers posing as IT support, pushing employees to sign in via attacker-controlled phishing pages,…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
Google reports UNC6671 is still actively compromising organizations by calling employees and pretending to be IT helpdesk staff running an urgent security migration. Victims are pushed to visit lookalike login pages that steal passwords and MFA codes, which then enables data theft and extortion…
Kali365 is a phishing kit that abuses Microsoft’s real “device code” sign-in flow to trick employees into approving attacker-controlled login codes. Once a victim completes authentication on Microsoft’s legitimate page, attackers can receive access and refresh tokens that may grant ongoing access…
