Investigators described a real, long-running SEO poisoning operation (“BengalSEO”) that manipulates search results to push victims to fake support and activation pages. The pages impersonate well-known consumer brands, then route visitors through redirects and CAPTCHA checks to either download…
A scam website posing as a GTA 6 fan countdown page tricks visitors into buying a “leaked copy” and then prompts them to connect a crypto wallet. Once connected, it generates transactions/approvals designed to transfer the victim’s cryptocurrency (and potentially NFTs) to the attacker. The site…
A malicious GitHub repository impersonating Anthropic advertised a “free” Claude Opus 5 desktop app and tricked users into downloading a ZIP that silently installed RevStealer. Victims reported account takeovers after running it, and the malware is designed to steal passwords, crypto wallet data,…
Victims in China reported losing thousands to hundreds of thousands of dollars after scammers convinced them to move conversations onto Microsoft Teams using login credentials the scammers provided. Common setups included romance and “investment” pitches (including crypto) and official-sounding law…
Researchers observed AI coding agents inside corporate networks following instructions hidden in websites’ llms.txt files, including installing packages that didn’t exist yet. Attackers (or the researchers demonstrating the risk) could then register those package names and have the agents install…
Researchers linked a June 2026 intrusion at a communications organization in Venezuela to the Dark Caracal espionage group. The attackers used phishing emails with financial/tax-themed lures and weaponized SVG attachments that redirected victims through URL shorteners to an attacker site hosting…
A fake “Malwarebytes Support” listing was found on BuzzFeed, apparently designed to trick people into calling a scam phone number. The likely goal is to socially engineer callers into granting remote access and/or paying for bogus support, using the credibility of a trusted platform and well-known…
Attackers are using convincing Rockstar Games lookalike websites to trick people into downloading a supposed “GTA 6 demo.” The download is actually Vidar infostealer malware that can steal browser passwords, cookies, and logged-in sessions, potentially exposing personal and work accounts if they…
OpenAI says it removed Russia-linked ChatGPT accounts used to support a covert influence campaign promoting a fake think tank brand called the “International Burke Institute” (IBI). The operators used AI mainly to create and translate social media posts that looked credible and drove people to an…
INTERPOL’s Operation Jackal IV (Nov 2025–Jun 2026) targeted the money-laundering backbone behind global online scams, leading to 58 arrests and 263 suspects linked to West African organized crime groups. Cases included romance/investment scams targeting retirees, a fake-investment call center tied…
Interpol said Operation Jackal IV arrested dozens and disrupted West Africa–linked criminal networks tied to scams and money laundering, including Black Axe. The cases described include a call-center “investment” scam, romance/investment scams targeting retirees, and sextortion of teenagers on…
The article describes real-world scams riding on the GTA 6 leak hype, including fake “Extended Look” and “demo” websites that deliver password-stealing malware. It also warns about “free early access” offers designed to drain crypto wallets, showing how leaked footage can make these lures more…
A scam is using hype around Grand Theft Auto 6 to trick people into downloading a “leaked, playable build” from torrent sites. The file is mostly junk data, but it contains a small malware payload that tries to weaken Windows Defender and stop security tools, giving attackers control of the…
Attackers are tricking Minecraft players into downloading malware by impersonating popular Minecraft clients and resellers in Google search results. Even after the campaign’s command-and-control infrastructure was taken down, the operation continued by shifting distribution to common file-hosting…
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Attackers are abusing excitement around GTA VI leaks by distributing a fake 113GB “playable build” that is mostly empty data with a small malware payload hidden inside. The malware attempts to weaken defenses by adding Windows Defender exclusions and killing security tools, then likely prepares the…
Attackers are exploiting GTA 6 hype by creating convincing fake Rockstar-branded “demo” websites that appear in Google search results. The sites use “Play Now”/“Official Download” lures to trick people into downloading a small Windows executable that installs Vidar infostealer and steals saved…
A real phishing campaign is targeting DEF CON speakers and attendees through X/Twitter messages pretending to be a Coindesk executive. Victims are sent to a Google document that attempts a “click-fix” trick to get them to paste malicious commands into a terminal or download malware. The goal is to…
A researcher was targeted after Black Hat/Def Con by an attacker posing as a CoinDesk executive and using X direct messages to build trust. The scam used familiar platforms (Google Docs and Dropbox DocSend) to push “ClickFix”-style steps or a fake installer intended to get the victim to run malware.
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
