EvilTokens is a real phishing-as-a-service operation that abuses Microsoft’s device-code sign-in process to persuade victims to grant access to their Microsoft 365 accounts. After access is granted, its AI analyzes inboxes and business relationships, identifies people involved in payments, and…
A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic…
This weekly roundup describes several real social-engineering campaigns, including fake government-payment posts that compromised thousands of Bluesky accounts and mobile scams disguised as community activities. It also documents AI-generated bank-helpdesk calls that persuaded victims to install an…
A scammer allegedly used Amanda Smith’s personal information to open a Cash App account and receive $1,000 from a buyer tricked by a fraudulent Facebook Marketplace listing. The case shows how an account takeover, fake sale, and identity theft can leave both the buyer and the person whose identity…
A phishing campaign targets YouTube creators with a fake, invite-only Amazon Music advertising deal. The fraudulent site uses each creator’s real public channel statistics to appear legitimate, then places a fake Google sign-in screen over the page to capture Google passwords and multi-factor…
Socure research describes how people are using generative AI to create fake hardship letters, income statements, and bank statements to support fraudulent claims using their own identities. The report also observed large-scale account and promotion abuse during the 2026 World Cup, where fraudsters…
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
A Brazilian bricklayer traveled 2,000 km after an AI-generated social-media persona offered him a serious relationship, a place to live, and payment for his trip. The case shows how public videos that simulate personal conversations can create a convincing romance-style lure, even when there is no…
A real deepfake during Ireland’s 2025 presidential election falsely depicted candidate Catherine Connolly saying the election was cancelled, that she was withdrawing, and that her supporters should not vote. The UK Electoral Commission is developing a rapid detection system because similar false…
Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…
Researchers disclosed SearchLeak, a Microsoft 365 Copilot Enterprise vulnerability chain that reportedly let a single crafted-link click turn a user’s AI assistant into a tool for collecting and sending out sensitive data. The attack abused prompt injection and trusted Microsoft infrastructure,…
Attackers hijacked two official Irish police X/Twitter accounts and used the trusted accounts to promote a fake cryptocurrency airdrop. The posts directed followers to a link that could trick them into giving up cryptocurrency-wallet keys, allowing criminals to drain their funds.
Scammers are targeting YouTube creators by posing as brands offering sponsorships and sending personalized emails that reference the creator’s videos. Victims are directed to a convincing fake collaboration platform and then prompted to sign in with Google, putting their accounts at risk.
ESET reports that Russia-aligned group UAC-0099 is using spearphishing emails with malicious links to deliver a downloader called MATCHBOIL. The attack relies on tricking a person into manually running a downloaded VBScript, which then fetches and installs further malware and sets up persistence…
Scammers are targeting YouTube creators with personalized “sponsorship” emails that lead to a convincing fake collaboration website. The site pulls public channel data, then asks the creator to “Sign in with Google” to “verify” the channel, stealing the password and one-time code to take over Gmail…
Researchers say the Russia-aligned group UAC-0099 has been phishing Ukrainian organizations with malicious links that install a data-harvesting malware called MatchBoil. The emails have included lures like fake Ukrainian court summonses, and clicking the link leads to downloading an archive that…
A recent scam targets YouTube creators with personalized “paid collaboration” emails that impersonate well-known brands and push victims to a fake collaboration platform. The site then routes victims to a Google sign-in step that can capture credentials or trick users into granting dangerous…
Researchers found a real phishing operation that pretends to offer AI marketing tools (e.g., “Muse Ads”) and prompts users to click “Connect” to log in. The login pop-up looks like Google or Okta, but it’s a fake browser window embedded inside the webpage, designed to steal passwords and MFA codes,…
Attackers briefly took over Microsoft’s official Twitter/X account and rebranded it with a Clippy avatar to push a Clippy-themed cryptocurrency scam. Posts suggested the token was tied to Microsoft’s stock price, potentially tricking followers into thinking it was legitimate. A fake “corporate”…
Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
