A scammer called Graham Cluley while spoofing the real Crime Stoppers phone number and posed as a police detective investigating cybercrime. The caller tried to build trust, claimed to have evidence tied to Cluley (including a passport scan), and steered the conversation toward his Trezor hardware…
A real incident described in the article involved criminals using a deepfake Zoom call where all participants (including the CFO’s boss) were fabricated, convincing a Singaporean CFO to transfer US$500,000. The article focuses on Fraunhofer SIT’s prototype to detect deepfakes in live video calls…
OpenAI says it disrupted a Cambodia-based scam network operating from Poipet that used ChatGPT to scale romance, investment, gambling, and law-enforcement impersonation scams. The group used messaging apps to build trust, then pressured victims to pay deposits, activation fees, or fake fines,…
Cisco Talos reports that real threat actors are using AI coding assistants and chatbots to support scams and hacking workflows by bypassing safety guardrails with simple “authorized use” claims. The logs show attackers persuading models that activity is allowed (e.g., ownership/bug bounty/CTF…
A foreign investor signed transaction documents for a €10M land purchase after being told one document would “protect the company.” The document instead granted broad power of attorney and sale-like authority, and the investor discovered the issue only 18 months later when the local lawyer stopped…
Attackers are impersonating Bank of America in mass phishing emails to pressure people into clicking a link “to avoid account restrictions.” Mac users are led to a fake login page that steals credentials and personal/financial data, while Windows users are tricked into installing a ScreenConnect…
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
CrowdStrike reports multiple real-world campaigns where attackers used human manipulation to break into organizations, including LinkedIn outreach that led to a malicious link click and phone-based scams that pushed victims to fake sign-in pages. The report also describes attackers abusing stolen…
OpenAI says it disrupted a Cambodia-based scam network that used ChatGPT to run investment and romance scams, impersonate law enforcement, and recruit workers using fake job ads aimed at people in India. The group used the tool to create believable personas, translate scam messages, and generate…
CrowdStrike’s threat hunting report says attackers are increasingly using phone-based impersonation and trusted login flows to break into cloud email and SaaS quickly. The report highlights vishing callers posing as IT support, pushing employees to sign in via attacker-controlled phishing pages,…
A lawsuit alleges a counterfeit “Sparrow Wallet” app was allowed to remain in Apple’s App Store for months, leading investors to lose about $1.8M in Bitcoin. Victims reportedly entered their wallet “seed phrases” into the fake app, letting the scammer take over their funds. The case is a reminder…
Researchers say criminals are cloning popular GitHub repositories for AI tools and developer resources, then quietly changing installation instructions to deliver an infostealer. The pages look legitimate (including original contributors), which lures developers into downloading and running a ZIP…
Microsoft reports a Russian state-backed operation that compromises hotel and conference Wi‑Fi “captive portals” to redirect travelers to fake Microsoft 365 sign-in pages or fake update prompts that install malware. One method abuses Microsoft’s device-code login flow so victims unknowingly approve…
Barracuda researchers simulated how an attacker who already compromised one employee mailbox could use the account’s built-in email AI assistant to hide evidence, learn org context, and draft convincing internal phishing emails. In their proof of concept, the attacker used an invoice-themed link to…
Scammers are mailing official-looking “IRS” letters to cryptocurrency holders, urging them to scan a QR code and enroll in a fake “Digital Asset Compliance Portal.” The QR code leads to a fraudulent IRS-lookalike site that gathers wallet/exchange details and then prompts victims to provide a phone…
Scammers are mailing physical letters that mimic official IRS notices and pressure cryptocurrency holders to “enroll” in a fake Digital Asset Compliance Portal. Victims are driven to scan a QR code, enter details about their exchange and holdings, and provide a phone number for a follow-up call.…
Microsoft says a Russia-linked group compromised hotel and conference guest Wi‑Fi sign-in systems to redirect travelers to phishing pages and fake “update” prompts. The goal was to steal credentials (including Microsoft 365) and push malware when devices automatically check connectivity after…
CrowdStrike warns that attackers are using AI to make social engineering faster and more convincing, including AI-generated resumes and deepfake job interviews to infiltrate companies. The report also describes vishing campaigns that quickly pivot from stealing accounts to stealing data from SaaS…
This weekly threat bulletin summarizes multiple real-world incidents, including phishing that abuses Microsoft’s legitimate app login/consent screens and a campaign that hijacks hotel Wi‑Fi captive portals. In both cases, the goal is to trick people into granting access or capturing Microsoft…
Microsoft and ReliaQuest report a real campaign where attackers tampered with public Wi‑Fi captive portal networks (hotels/conference venues) to redirect users to attacker-controlled pages. The goal was to steal Microsoft 365 credentials (and sometimes deliver malware) by using…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
