This bulletin highlights multiple real-world threats, including voice-phishing (vishing) operations that industrialize account takeovers and a fake CCleaner download site that installs spyware. The items provide concrete, repeatable lures (a vishing-driven takeover workflow and a lookalike software download) that can be turned into realistic awareness simulations.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: your phone rings, and a "security team" walks you straight into a fake login and spyware install in under two minutes. There’s a tool called Work Panel that lets criminals spin up vishing campaigns like a call center: one button to register a phishing domain, clone your company’s login, and launch a brand-new fake site in minutes. The script sounds like this: "Hi, this is the security team about suspicious sign-in activity." They give you a login link, watch you sign in, grab your codes, then send you to a fake CCleaner site like ccleanerwind.top that drops a GhostDesk Chrome extension to steal your passwords and screenshots. Your move: if anyone calls about “securing your account” and tells you where to log in or what to install, hang up and instead use your normal bookmark or our official portal to check your account yourself.
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Rapid7 uncovered an active cryptocurrency fraud operation that combined phishing emails, follow-up phone calls, and counterfeit wallet apps to trick victims into handing over wallet recovery (seed) phrases. The attackers validated and enriched phone-number leads first, then used matching “support…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
A joint UK-US-Dutch advisory warns Iranian state-backed cyber actors are targeting dissidents, activists, and journalists by first contacting them on WhatsApp or Telegram and building trust. The attackers then persuade victims to open a malicious file disguised as legitimate software (or even MRI…
This weekly threat bulletin highlights multiple real-world incidents, including a healthcare data breach claim where attackers reportedly used phone-based social engineering (vishing) to compromise identity accounts and access cloud apps. It also describes a large-scale “debt relief” email phishing…
