The FBI warns that criminals are breaking into social media and personal accounts to steal explicit images and sell or share them online, often with the victim’s personal details attached. The warning highlights specific tactics such as password guessing from breached data, fake “account will be…
Researchers reported a phishing setup that clones WhatsApp and Instagram login pages and uses valid HTTPS (TLS) certificates to look legitimate. Victims are lured via WhatsApp messages about “verification,” “pending payments,” or “customer support,” then sent to typosquatted lookalike domains to…
Investigators say an online game, “Drone Battle: Ukraine,” is being used as a lure to draw young people into a broader recruitment pipeline connected to Russia’s Alabuga Special Economic Zone. The campaign reportedly uses social media, influencers, esports, and promises like scholarships and travel…
The FBI warned that criminals are breaking into personal and social media accounts to steal and share intimate images and videos without consent. The campaign uses social engineering like fake customer-service texts and phishing “new login” emails to trick victims into handing over verification…
Criminals are using fake pirated downloads of Christopher Nolan’s “The Odyssey” to trick people into running password-stealing malware. The files look like normal movie downloads (and may even use VLC-style icons), but are actually Windows executables that install Lumma Stealer to grab saved…
League of Legends players report bot accounts sending friend requests right after matches, opening with flattery, and quickly moving the chat to Discord. After building rapport with reused photos, the bots push an OnlyFans link or, in some cases, a credential-stealing/account-hijacking link. The…
A TrendAI (Trend Micro) report describes a structured underground market where criminals recruit employees to provide access, approve transactions, and bypass controls, often via Telegram and hacking forums. The article gives concrete examples (e.g., paying a FedEx employee $1,000/day to update…
Scammers are using AI deepfakes to impersonate real OnlyFans creators on social media and trick fans into paying for “live chats” or exclusive interactions. Victims are funneled from TikTok to private messages (e.g., Snapchat) and then pressured to send money via Cash App, after which the scam…
PortSwigger research shows how attackers can weaponize HTML/CSS inside emails to cross trust boundaries in webmail, including UI manipulation, token theft, and password theft. The paper highlights real-world weaknesses in email sanitization and gives concrete examples (including an Outlook…
Telegram says extortionists are planting illegal content into public group chats, then reporting it to Apple to trigger App Store takedowns. The alleged goal is to pressure group owners into paying ransom to avoid being targeted. The trick relies on hiding the illegal content by editing an older…
Criminals are impersonating OnlyFans creators using AI-generated deepfake videos and cloned voices to trick fans into paying for “exclusive” chats or content. The scam typically starts on TikTok, moves victims into direct messages on Snapchat, then pushes instant Cash App payments, after which the…
OpenAI says it disrupted a Cambodia-based scam network operating from Poipet that used ChatGPT to scale romance, investment, gambling, and law-enforcement impersonation scams. The group used messaging apps to build trust, then pressured victims to pay deposits, activation fees, or fake fines,…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
OpenAI says it shut down a coordinated network of ChatGPT accounts linked to Cambodia that supported multiple real-world scams, including investment, romance, gambling, and law-enforcement impersonation. The group used AI to create fake personas, translate and generate persuasive messages on…
A real phishing campaign targeted Call of Duty Mobile players by promising free in-game currency. Victims were tricked into entering their email and password, then providing a 2FA code on a follow-up page, enabling attackers to take over accounts.
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
Scammers are setting up fake Fortnite “rewards,” “locker value,” and “competition” websites that funnel players to a fake Epic Games login page. The sites trick people into signing in so attackers can steal Epic usernames and passwords, then take over accounts for resale, fraud, or further scams. A…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
A U.S. Senate hearing highlighted how criminals are using AI to make classic scams more believable, including voice cloning and fabricated “trusted” identities. One victim reported a phone-based “kidnapped daughter” deepfake that drove her to send cash, while a doctor described deepfake ads using…
A state-sponsored campaign in South Korea used spear-phishing and hacked “trusted” local websites to infect visitors who had vulnerable AnySign4PC installed. In some cases, simply visiting a compromised page triggered the exploit and installed SIGNBT or COPPERHEDGE backdoors without any download…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
