CrowdStrike’s threat hunting report says attackers are increasingly using phone-based impersonation and trusted login flows to break into cloud email and SaaS quickly. The report highlights vishing callers posing as IT support, pushing employees to sign in via attacker-controlled phishing pages, enabling rapid takeover and data theft in minutes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you pick up the phone and hear, “This is IT personnel calling to help you authenticate.” CrowdStrike saw vishing like this double in 2026. Groups like CORDIAL SPIDER and SNARKY SPIDER pose as IT, then walk you to a “secure” Microsoft 365 or Google Workspace login page. Here’s the trick: they use adversary-in-the-middle phishing pages and OAuth device code prompts that look legit. You type your password, approve the sign-in, and in under five minutes they’re inside your email and files. Aha moment: real IT will never make you log in while you’re on the call. If anyone does, hang up and contact IT using our official helpdesk or ticketing system instead.
CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
The article highlights real, ongoing campaigns where attackers trick people into installing malware via fake software-download websites and a disguised browser extension. These lures are used to steal credentials, browser cookies, and authenticated sessions, letting attackers take over accounts…
UNC6671 is running real-world voice phishing (vishing) campaigns where callers impersonate IT help desk staff and create urgency around “mandatory” security changes. Victims are pushed to spoofed login pages that capture passwords and MFA codes, enabling attackers to access and steal data from SaaS…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
Microsoft says attackers are impersonating IT support and using “passkey/MFA/SSO update” requests to trick employees into authenticating attacker-controlled sessions. The campaigns use attacker-in-the-middle phishing sites or device-code logins to capture valid session tokens, then access Microsoft…
