Researchers describe an active, widespread email campaign that tricks employees with voicemail-themed messages and steals Microsoft 365 login sessions (including MFA codes). After taking over accounts, attackers quietly search and collect payroll/HR/finance emails and identify people involved in payment workflows, while using residential proxy logins to blend in.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get this email: “New voicemail message, sign in to listen.” Looks normal, right? It’s actually a trap for your Microsoft 365 account. You click the voicemail link, it bounces through Google Meet, Google Ads, even an Amazon S3 URL, then lands on a perfect-looking Microsoft login page that asks for your password and MFA code. That’s an adversary-in-the-middle page quietly stealing your entire session. Once they’re in, they reuse your session from residential proxies that look local, quietly search payroll, HR, and finance mailboxes, and even drop inbox rules that move certain emails to Deleted Items and mark them read so you never see the signs. Here’s the move: treat every voicemail email as high risk. If you get one, don’t click the link, open your usual Microsoft 365 or phone app directly and check voicemail there instead.
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
