Users reported getting repeated, unsolicited password-reset emails from X after the launch of X Money. The emails appear legitimate, but attackers may be using them to confuse users and then send follow-up phishing messages that lead to fake X login pages to steal credentials. There is no confirmed evidence yet that the reset flood has resulted in successful account takeovers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Out of nowhere, your inbox blows up with real X password reset emails right after X Money launches. Attackers abuse account recovery using your public X username, then slip in a follow-up email: 'Your account needs to be secured or reset' with a link to a fake X login page. Here’s the trap: because the first reset emails are real, that phishing email feels legit, especially now that X Money makes your X account more valuable for financial fraud. If you get a reset flood, don’t click any email link, open the official X app or type x.com yourself to sign in and check your account.
A recent scam targets YouTube creators with personalized “paid collaboration” emails that impersonate well-known brands and push victims to a fake collaboration platform. The site then routes victims to a Google sign-in step that can capture credentials or trick users into granting dangerous…
Researchers reported a phishing setup that clones WhatsApp and Instagram login pages and uses valid HTTPS (TLS) certificates to look legitimate. Victims are lured via WhatsApp messages about “verification,” “pending payments,” or “customer support,” then sent to typosquatted lookalike domains to…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
Microsoft reports a real Midnight Blizzard-linked campaign where attackers tamper with hotel Wi‑Fi captive portals to redirect travelers to phishing and fake update pages. The goal is to steal credentials or trick users into installing malware, which can follow employees back into corporate…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Attackers broke into Brevo, the email platform Trezor uses for newsletters, and sent a phishing “security warning” from Trezor’s real mailing system. The email claimed a serious hardware issue could expose wallet recovery seeds and pushed people to a malicious site/app that asked for a wallet…
