Attackers used paid Google ads to direct people to fake Claude download pages hosted on Anthropic’s real claude.ai website. The pages used a ClickFix trick: they told Mac and Windows users to paste a command into their device, installing password- and cryptocurrency-stealing malware. Because the…
ICMacOS is a commercially sold Mac malware kit that uses fake websites to convince victims to paste a command into Terminal. The command installs malware and displays a fake macOS password prompt, putting browser credentials, cloud access, developer secrets, and cryptocurrency wallets at risk. The…
Three real malware campaigns targeted people in Brazil and Portugal with fake legal notices, invoice pages, and finance-themed documents. Victims were directed to scripts, installers, or an ISO file that abused trusted VLC, VMware, and Microsoft utilities to load malicious code. The most useful…
The article recounts the real ILOVEYOU worm outbreak, which used a romantic email subject line and a supposed love-letter attachment to trick millions of recipients into infecting their computers. Once opened, the attachment spread the same message to everyone in the victim's address book, showing…
Keystone confirmed that an attacker accessed customer shipping and order information, and a customer reported a social-engineering phone call using those details. The exposed information can make fake support messages and calls about refunds, replacement devices, or order fixes sound credible.…
U.S. authorities allege that Zheng Zhao and co-conspirators used relationship-building scams to persuade at least 174 Americans to invest in fake cryptocurrency platforms. The group contacted victims through social media, dating sites, calls, and text messages, then showed false investment growth…
Dutch police arrested two suspects accused of using AI-generated bank fraud calls to steal more than €380,000 from 170 victims. The callers falsely warned of suspicious account activity, then posed as bank employees and persuaded victims to download an app and tap their debit card to their phone,…
Researchers linked the uCreator Android spyware kit to real campaigns that used ads and fake app-store sites to distribute tampered Telegram X apps. The sites marketed Telegram X as a dating and video-chat app, persuading victims to sideload it; once installed, the altered app could steal Telegram…
EvilTokens is a real phishing-as-a-service operation that abuses Microsoft’s device-code sign-in process to persuade victims to grant access to their Microsoft 365 accounts. After access is granted, its AI analyzes inboxes and business relationships, identifies people involved in payments, and…
TransUnion reports that criminals are using trusted brands and compromised customer information to trick people into sharing details, one-time passcodes, or access to their accounts. The scams exploit normal-looking security requests and can lead to account takeovers, redirected payments, and…
Attackers used fake Microsoft sign-in pages and device-code tricks to steal completed Microsoft 365 login sessions, then replayed those sessions without needing passwords or new MFA approvals. After entering accounts, they registered rogue devices, replaced MFA methods, and hid mailbox messages,…
A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic…
INTERPOL’s Operation Serengeti III arrested 1,462 suspects across 21 countries targeting fraud, phishing, business email compromise, ransomware, and digital extortion. In Uganda, investigators found scam call centres using prepared scripts and fake trading platforms to persuade people, including…
This weekly roundup describes several real social-engineering campaigns, including fake government-payment posts that compromised thousands of Bluesky accounts and mobile scams disguised as community activities. It also documents AI-generated bank-helpdesk calls that persuaded victims to install an…
Scammers are persuading victims in Norway to buy gold, claiming they will safeguard it, then arranging a handoff that never happens. After building trust, sometimes through a fake romance, the scammers tell victims to leave the gold in a forest or public park, where it can be collected anonymously.
Interpol's Serengeti III operation led to 1,462 arrests across Africa and the recovery of more than $105 million linked to cybercrime. In Uganda, fraud rings used call-center scripts, fake trading platforms, and fraudulent websites to persuade pensioners in Asia to invest in fictional…
A scammer allegedly used Amanda Smith’s personal information to open a Cash App account and receive $1,000 from a buyer tricked by a fraudulent Facebook Marketplace listing. The case shows how an account takeover, fake sale, and identity theft can leave both the buyer and the person whose identity…
INTERPOL’s Operation Serengeti III led to 1,462 arrests across 21 countries and disrupted fraud, ransomware, business email compromise and other cybercrime operations. One major case involved rotating call centers that used scripted investment pitches, fake trading platforms and fraudulent websites…
Attackers are abusing legitimate services such as Dell and Staples to send real, authenticated emails containing fraudulent support phone numbers. The emails pass normal authentication checks because the trusted platform sends them, but the attacker controls fields displayed in the message and uses…
This report describes real-world AI agent failures that exposed internal screenshots and personal bank information without a traditional attacker. It also documents a prompt-based technique that can bypass some AI safety controls and a repository-delivery flaw that can run code before a developer…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
