Researchers say the Russia-aligned group UAC-0099 has been phishing Ukrainian organizations with malicious links that install a data-harvesting malware called MatchBoil. The emails have included lures like fake Ukrainian court summonses, and clicking the link leads to downloading an archive that…
Researchers at ANY.RUN report a real-world phishing operation (“Wazza”) targeting banking, government, and manufacturing in the U.S., Europe, and Australia. The campaign uses a multi-step redirect and validation chain to filter out bots and only then shows an Adobe-branded “Device Code” sign-in…
Researchers found 16 malicious Firefox browser extensions pretending to be Rabby or OKX crypto wallets. When a user imports a wallet, the fake add-ons capture the recovery phrase/private key and send it to attacker-controlled Cloudflare Workers, enabling wallet takeover and theft.
Surfside Beach, South Carolina lost $545,598.30 after staff wired money to a fraudulent account based on emails from a lookalike domain. The forensic review found no compromise of the town’s internal systems or Microsoft 365, attackers simply registered a near-identical domain and used it to…
Barracuda analyzed a real phishing campaign where one email was designed to trick both a person and the AI assistant summarizing their inbox. The messages used normal phishing lures (like password-protected attachments) while also hiding “prompt injection” instructions to make AI summaries label…
Microsoft observed a ClickFix campaign where compromised websites cache a hidden payload in the victim’s browser, then trick the user into pasting a command (often via Win+R) that executes what’s already on the device. The method helps attackers hide the payload and get around Windows “Run”…
Nikkei said an attacker took over an employee’s Microsoft 365 email account and used it to send about 9,000 phishing emails to people who had previously communicated with Nikkei staff, including journalistic sources. The messages contained links leading to malicious websites, creating a high-trust…
A phishing operation dubbed “Milk Dragon” uses fake discount posts on Facebook and TikTok to lure shoppers to lookalike online stores. Victims are tricked into entering payment card details and then a one-time password on a spoofed 3D Secure verification page, enabling fraudulent purchases or…
Huntress reports attackers are increasingly installing legitimate remote monitoring and management (RMM) tools after a phishing click, giving them persistent remote control that can blend in with normal IT activity. The article also describes common identity-focused schemes like hidden mailbox…
Attackers are using sponsored Google ads to route people to a malicious “custom GPT” that looks like ChatGPT, even while the user is logged in on the real ChatGPT domain. The fake GPT displays a convincing “service availability” message and pushes a link to a “backup domain” that ultimately…
Researchers found dozens of lookalike websites impersonating real crypto projects and promising a small, believable reward boost if users “vote” on a rewards distribution date. The vote is fake; clicking “Vote now” triggers a wallet connection prompt and can lead to malicious approval/signature…
Researchers report a sharp rise in scam victims at hundreds of financial institutions, with many scams starting on mobile devices. The article walks through a real scam session where a victim, guided by a phone call and remote access software, nearly sent a high-risk transfer to a new payee. It…
The article describes how real-world attackers are shifting common breach activity into the web browser, including phishing that steals live sessions, fake “copy/paste to fix” prompts (ClickFix), and OAuth consent/device-code tricks. It highlights how these browser-based lures can bypass MFA and…
Microsoft reports that the Russia-linked group Star Blizzard expanded from highly targeted spear-phishing to larger email campaigns aimed at Ukraine supporters globally. Lures included tax-audit/unpaid-fine notices and fake conference invitations, followed by a password-protected archive that…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
Microsoft reports that the Russia-linked group Star Blizzard expanded from small, highly targeted spear-phishing to larger “mass-mailing” email campaigns aimed at governments, think tanks, and nonprofits, especially those connected to Ukraine. The lures often promise exclusive events or warn about…
Microsoft reports Russia-linked Star Blizzard sent fake event invitations and other business notices to trick targets into opening disguised files that install a Windows backdoor. The campaigns targeted Ukraine-linked people and organizations and hit 100+ organizations, mainly in the U.S. and U.K.,…
Microsoft reports that the Russian state-linked actor Star Blizzard ran large-scale phishing campaigns in 2026 that use convincing lures like tax notices, fines, and “closed-door” event invitations. After a victim replies, the attacker sends a password-protected ZIP/RAR attachment that triggers a…
A real ClickFix campaign abused ChatGPT “Custom GPTs” to impersonate legitimate tools and trick people into running PowerShell commands on their own computers. Victims were funneled from a sponsored Google result to a fake “backup domain” on Google Sites with a Cloudflare CAPTCHA-style prompt,…
The article describes how real-world phishing and social engineering are evolving to bypass the checks employees are trained to use (bad grammar, suspicious URLs, obvious fake login pages). It highlights specific, observed attack workflows including QR-code “device hop” phishing, OAuth token theft…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
