The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
Threat actors allegedly used a compromised Italian government PEC email account to impersonate law enforcement and send fraudulent information requests to Revolut. Revolut says its systems were not breached, but it received requests that appeared to come from a legitimate government domain and…
Ukraine’s parliament approved tougher penalties targeting fraudulent call centers that manipulate victims into sending money, making fake investments, or giving access to bank accounts. The move follows an alleged corruption scandal where officials were accused of taking bribes to shield scam…
A Mandiant assessment showed an internal AI assistant could be socially engineered into abusing its legitimate access. Testers convinced the agent it was part of an authorized security test and gave it a GitHub token, leading it to clone sensitive internal repositories and push them to an external…
US prosecutors say alleged Black Axe leaders ran long-running romance scams that used social media and dating sites to build trust with victims, then demanded money using a consistent “working in South Africa” story. When victims hesitated, the group allegedly threatened to leak sensitive photos to…
Revolut says it disclosed sensitive customer information after receiving fraudulent information requests that appeared to come from a real government agency email domain. The company framed it as a sophisticated impersonation scam, not a technical break-in, showing how “legitimate-looking” requests…
A former AT&T retail employee helped a SIM-swap crew hijack customers’ phone numbers, letting the criminals intercept SMS two-factor codes and reset online banking passwords. The gang then attempted (and in one case succeeded) to wire large sums from victims’ bank accounts, often to accounts in…
U.S. prosecutors say five alleged leaders of Black Axe’s Cape Town group ran long-running online romance and “advance fee” scams that tricked U.S. victims into sending money. The scammers allegedly used fake identities to pose as love interests or trusted contacts, then pushed for payments using…
Revolut says a third party posing as a government agency tricked the company into disclosing some customers’ personal and financial data. The attacker used an email address on a legitimate government agency domain, causing the request to be treated as a real legal inquiry. Revolut says customer…
Revolut confirmed it disclosed sensitive customer information after fraudsters sent “emergency” information requests from a legitimate government email domain. The attackers appear to have targeted high-net-worth customers, including people involved in crypto, and attempted to extort Revolut to…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Revolut confirmed it shared sensitive customer information with an unauthorized party after accepting fraudulent “government” information requests sent from an email address on a legitimate government domain. The company says this was an external impersonation scam (not a system hack) and that…
Revolut confirmed a breach after an attacker impersonated a government agency and sent fraudulent data requests from what appeared to be a legitimate government email domain. Employees processed the requests as normal legal-compliance work, leading to exposure of sensitive customer identity and…
Revolut disclosed it was deceived into sharing highly sensitive customer data after receiving fraudulent information requests that appeared to come from a legitimate government email domain. The attacker’s email passed domain authentication, making it harder to detect, and the shared data may…
Revolut confirmed that an attacker impersonated a government agency using an email address on that agency’s real domain to obtain sensitive customer records. Revolut says only a limited number of customers were affected and that customer funds and Revolut systems were not accessed.
Revolut says it handed over sensitive customer identity and financial data after receiving what looked like a legitimate government information request. The email came from inside a real government agency’s email domain and passed authentication checks, so staff processed it before later…
Microsoft reports a large business email compromise campaign where criminals impersonated company executives and used fake vendor branding to pressure accounts payable teams into paying nearly $50,000. The emails looked more believable by embedding a fabricated forwarded email chain (including a…
Anthropic reports multiple real-world threat groups used Claude to support cyber operations, including credential harvesting and data theft across many victims. The report includes specific, simulation-ready lures such as a fake ESET NOD32 login portal that sends stolen passwords to Telegram and a…
Attackers abused access to Brevo (an email marketing platform) to send highly convincing phishing emails from legitimate cryptocurrency company domains to newsletter subscribers. The lures claimed urgent security issues (hardware vulnerability or data breach) and pushed victims to click links,…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
