This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
Governments are responding to deepfakes by shifting from “detecting fakes” to building systems that prove where digital content came from and whether it was altered. The article cites real AI-impersonation activity targeting government officials, including text and AI-voice impersonation intended…
Researchers reported a real espionage campaign (“SilkParasite”) targeting Central Asian government bodies using spear‑phishing emails. The attack uses password‑protected RAR files containing malicious Microsoft Office documents; when opened, macros trigger a DLL sideloading chain to install remote…
Researchers showed how an attacker could trick Microsoft Copilot into running a malicious prompt automatically just by getting a user to click a specially crafted link. The prompt can then make Copilot search connected accounts (like email and cloud storage) and send information to an external…
The article describes how attackers use QR codes in emails (“quishing”) to hide malicious links, push victims onto less-protected mobile phones, and steal credentials or MFA tokens. It also cites an FBI notice describing North Korea’s Kimsuky using QR codes in spearphishing emails targeting think…
Researchers report Iranian-linked APT groups using legitimate cloud services to hide command-and-control traffic, and separately running spear-phishing campaigns. In the phishing cases, attackers used credible “podcast” or “interview invitation” themes to persuade targets to open a Windows shortcut…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
The article describes North Korean operatives posing as legitimate remote IT candidates to get hired, obtain real company credentials, and gain trusted internal access. It cites an FBI investigation into a DPRK remote IT worker at a U.S. federal agency and a research “hire-and-observe” operation…
This bulletin highlights multiple real-world threats, including voice-phishing (vishing) operations that industrialize account takeovers and a fake CCleaner download site that installs spyware. The items provide concrete, repeatable lures (a vishing-driven takeover workflow and a lookalike software…
A self-represented litigant hid “prompt injection” instructions in a court filing using tiny white text, aiming to influence any AI system that might read the document into ruling in his favor. The judge identified the concealed instructions as abusive and revoked the litigant’s electronic filing…
Acronis reported a real espionage campaign delivering a backdoor (PATCHCORD) to Afghan telecom providers and South Asian critical infrastructure by tricking victims into installing look‑alike VPN and telecom tools. The operation also used cloud services like Google Sheets (and GitHub Gists) to…
Singapore’s Cyber Security Agency is running a national exercise where volunteers receive simulated robocalls that mimic government impersonation scams, including AI-enabled calls. The article also points to real-world cases where criminals impersonated company executives on WhatsApp and even used…
CISA warns a Russian state-sponsored group (“Laundry Bear,” tracked by Microsoft as “Void Blizzard”) is compromising some unpatched Zimbra email accounts when users merely open or preview a specially crafted email. The hidden code can steal passwords, MFA-related tokens, and up to 90 days of…
A real phone scam convinced an elderly woman that her drinking water was unsafe and pressured her into buying four overpriced “water filters,” costing about €4,000. The article also describes common Portugal-targeted scams, including “Hi Mum/Hi Dad, I lost my phone” money-transfer fraud and SMS…
New Zealand’s intelligence service says a China-linked organization tried to install space ground infrastructure in New Zealand that could collect militarily useful intelligence, using a local partner that likely didn’t understand the capability or who would receive the data. The same assessment…
Cisco Talos reported a real-time phishing framework called “JWR” that guides victims through fake checkout and login pages while attackers watch keystrokes live. It is being delivered through SMS messages that impersonate toll and postal authorities, and it can capture payment details, identity…
Spanish police arrested a suspect accused of using real-time face-swap deepfakes during live video identity checks to obtain fraudulent digital certificates for later misuse. The article describes how the attacker relied on lighting tricks and camera injection to spoof document and biometric…
A self-represented plaintiff in a Connecticut court case hid nearly invisible text in legal filings to try to influence how an AI system might summarize or evaluate the documents. The court found the concealed “prompt injection” instructions (tiny white font) and sanctioned the filer, warning that…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
