Social engineering attacks on government agencies, from federal departments to municipal offices and the contractors around them. Each entry is broken down with an original video explainer, key findings, and the red flags your team should watch for. How we produce these.
A Ukrainian corruption investigation uncovered a network accused of paying officials to protect fraudulent call centers. The centers allegedly targeted victims in Ukraine and abroad by posing as bank employees, law enforcement officers, or financial advisers, and by directing people to fake…
A Russia-linked group assessed as APT29 compromised legitimate websites, cloned trusted websites, and tampered with a Ukrainian analytics service to target mobile visitors. The campaign delivered exploits to unpatched iPhone and Android devices, with fake sites impersonating a U.S. anniversary…
Russia-linked Midnight Blizzard compromised and cloned trusted websites to silently target iPhone and Android visitors in Europe and the United States. The campaign used watering-hole websites and a compromised web analytics service to profile devices and deliver exploit chains that could steal…
The article describes active campaigns that use familiar business documents, trusted file-sharing services, AI brands, and Microsoft sign-in flows to trick employees into granting account access. The most actionable patterns are phishing emails and document links that lead victims to Microsoft…
APT29-linked operators compromised trusted websites and a web-analytics supplier to silently target visitors’ mobile devices. Related campaigns also used World Cup-themed ads, fake prize pages, and instructions to open pages in Safari to steer iPhone users toward browser exploits. The practical…
Russian police arrested three suspected VasyGrek members after the group allegedly stole money from an organization through a phishing email. The attackers disguised the message as routine business correspondence and asked recipients to open a reconciliation report, which ran malware and enabled a…
Russia-aligned Gorbag has targeted Ukrainian government, justice, defense, and logistics organizations with convincing spearphishing emails. The group used a compromised local-government email account to send a fake administrative-fines notice with a malicious Excel attachment, then shifted to…
Russia-aligned group Gorbag targeted Ukrainian public-sector and defense organizations with spearphishing emails disguised as administrative fines and tax matters. The messages delivered malicious files that stole browser passwords, VPN settings, documents, and electronic-signature keys,…
Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and transport organizations with spearphishing emails disguised as routine administrative fines and tax notices. The group used compromised government email accounts and weaponized attachments to steal browser passwords,…
Russian authorities arrested three suspected members of VasyGrek, also known as Fluffy Wolf, a financially motivated group that used targeted phishing to access corporate systems and steal money. In one documented case, an accounting employee opened a malicious attachment disguised as a routine…
Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and military-aid transport organizations with phishing emails carrying malicious attachments. The emails were disguised as official administrative fine or tax documents, and opening them enabled theft of passwords, VPN…
Russia-aligned Gorbag targeted Ukrainian government, law-enforcement, and defense organizations with spear-phishing emails disguised as official administrative fines or tax notices. The emails carried malicious attachments, including macro-enabled Excel files, that installed data-stealing malware…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
Hackers reportedly compromised emergency-alert apps in Ukraine and Russia and used them to send false warnings of nuclear, radiation, chemical, and military threats. The incident exploited fear during an active conflict, and Ukrainian officials warned that at least one message included a link that…
A real campaign called Yoba used fake GitHub projects for supposed ChatGPT and Claude desktop applications to lure people into downloading malicious ZIP installers. The installers included legitimate signed OpenAI or Anthropic programs alongside malicious files, ultimately installing a…
A U.S. defense contractor admitted that co-conspirators used his identity and security clearance to apply for remote jobs at U.S. companies, including work tied to a military AI project. The case shows how fraudulent remote-job applicants can use a trusted U.S. identity, receive company equipment…
The Yoba malware campaign uses fake GitHub projects and search-result manipulation to make counterfeit ChatGPT and Claude downloads look trustworthy. Victims receive a real, signed installer alongside malware, so the application appears legitimate while the malicious software installs and…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
The article describes a real 2024 New Hampshire robocall that used an AI-generated voice impersonating President Biden. The call urged Democratic voters to stay home during the primary and wait until the November election, illustrating how voice deepfakes can be used to suppress turnout and…
Cisco says attackers used AI agents to break a malicious operation into small, routine-looking tasks. In one real campaign, the activity appeared to be authorized defense testing when viewed one step at a time, but the complete sequence revealed an effort to steal data.
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
