Researchers described a real phishing campaign using a platform called “ZeroTokens” that lets a live operator watch what a victim types and change the next phishing prompts in real time. The lure used “W-8BEN tax-documentation reviews” and spoofed financial institutions’ multi-step verification screens to steal credentials and sensitive identity/financial details, which were then used against the real institution.
The campaign centered on a phishing platform called ZeroTokens that gave a live human operator real-time visibility into what a victim was typing. Rather than relying on a static fake login page, the platform relayed victim inputs to an operator console over a persistent connection, letting the operator choose which screen to display next. Victims received emails using a W-8BEN tax-documentation review pretext, a plausible reason for anyone with US securities holdings to click a link and complete a form.
Once on the phishing site, victims were guided through up to eight stages modeled on a real financial institution's verification process. The flow was designed to collect login credentials, identity documents like driver's license details, card information, SMS verification codes, app-based approvals, and even a separate trading password. Because an operator could watch the session live, they could respond to failed verification attempts by presenting another prompt, keeping the victim engaged rather than letting the session end.
Several factors worked together to make this campaign effective:
Defenders and end users should be alert to a few specific signals from this type of attack:
Organizations, particularly in finance, should reinforce that passing email authentication checks does not mean a message is safe. Employees and customers should be trained to verify tax or compliance requests through a known official channel rather than clicking email links. Staff should also understand that legitimate verification processes will not repeatedly request MFA codes or app approvals mid-session, and that adaptive, unusually interactive web forms can indicate a live operator steering a scam rather than a normal automated system.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ZeroTokens is a phishing platform described in the campaign that gave attackers live visibility into victim sessions, letting an operator watch what a victim typed and adapt the next prompts in real time.
The campaign used a W-8BEN tax-documentation review pretext, targeting recipients with US securities holdings and spoofing a financial institution's multi-step verification screens.
No. The phishing messages passed SPF, DKIM and DMARC checks, showing that authentication passes alone do not guarantee a message is legitimate.
The observed flow collected login credentials, driver's license and card details, SMS verification codes, app-based approvals and a separate trading password.
You get an email: “Action required: W-8BEN tax-documentation review” from your brokerage, and it even passes SPF, DKIM, and DMARC. You click. A perfect copy of your bank’s site loads, then walks you through up to eight “verification” steps, login, driver’s license, card details, SMS codes, even a separate trading password. Behind the scenes, a platform called ZeroTokens is watching every keystroke over a live WebSocket. If you “fail” verification, it just invents another step to keep you entering more data, until they have everything they need to hit the real bank. If you get a W-8BEN or other tax-compliance email, don’t touch the link, go to your bank or brokerage site yourself and check for any alerts there.
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the…
ReliaQuest said it was targeted in a ShinyHunters-linked social engineering attack that used a fake domain hosting a ReliaQuest single sign-on (SSO) phishing page. Attackers then called employees while impersonating named security staff to push victims to the fake login page, resulting in one…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
