Attacks on consultancies, accounting firms, and other professional services providers that hold sensitive client data. Each entry is broken down with an original video explainer, key findings, and the red flags your team should watch for. How we produce these.
Baker McKenzie and Troutman Pepper Locke reported separate social-engineering incidents in which employees disclosed sensitive legal documents to unauthorized people. The attackers did not appear to break into either firm’s systems; instead, they relied on deceptive but credible-looking…
Check Point Research found the Haiou Codex jailbreak bundle on infrastructure used by a cybercrime actor. The bundle changes Codex instruction files so that simple greetings trigger a promotional response directing users to an LLM gateway website. Although the gateway was not confirmed as…
A real campaign called Yoba used fake GitHub projects for supposed ChatGPT and Claude desktop applications to lure people into downloading malicious ZIP installers. The installers included legitimate signed OpenAI or Anthropic programs alongside malicious files, ultimately installing a…
A U.S. defense contractor admitted that co-conspirators used his identity and security clearance to apply for remote jobs at U.S. companies, including work tied to a military AI project. The case shows how fraudulent remote-job applicants can use a trusted U.S. identity, receive company equipment…
The Yoba malware campaign uses fake GitHub projects and search-result manipulation to make counterfeit ChatGPT and Claude downloads look trustworthy. Victims receive a real, signed installer alongside malware, so the application appears legitimate while the malicious software installs and…
Attackers used GitHub and search results to promote counterfeit ChatGPT and Claude desktop downloads. The ZIP files bundled real signed OpenAI or Anthropic executables with malicious files, tricking Windows users into launching malware that can persist on the device and install a cryptocurrency…
U.S. authorities sanctioned people supporting a real North Korean scheme that placed workers in legitimate U.S. businesses using false identities and fabricated job applications. The workers reportedly used AI to tailor resumes and cover letters, create profile photos, and even conceal their…
Attackers sent personalized fake federal court notices to more than 100,000 companies, impersonating the US District Court for the Southern District of Florida. The emails directed recipients to a counterfeit court website and offered a password-protected case file that ultimately installed…
The article describes real malware-delivery operations that use fake open-source download sites, advertising redirects, and device profiling to decide who receives malicious content. Attackers hide the final payload behind ordinary-looking pages and scripts, while sending researchers, bots, and…
Attackers used fake ChatGPT, Claude, and Cursor AI application listings to trick Windows users into downloading malware. The downloads appeared trustworthy because they were hosted through GitHub and included real, digitally signed OpenAI or Anthropic executables, but malicious files alongside them…
Microsoft is adding AI-based phishing detection to Teams after attackers repeatedly used external chats to impersonate support staff, send malicious files, and deliver fake billing notices. The reported attacks exploit Teams' default external-access feature rather than a software flaw, making…
A real malware campaign called Yoba used fake GitHub projects advertising supposed ChatGPT and Claude desktop applications. Victims were lured by high-ranking Google results and download buttons, then ran ZIP-packaged installers that appeared legitimate but gave attackers control of the device. The…
Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
A real credential-phishing campaign used a project bid invitation and a password-protected PDF to target employees involved in sales and contract work. The PDF led victims through a convincing fake document-sharing site and then to a counterfeit Microsoft sign-in page that sent entered credentials…
Check Point Research identified a real campaign, tracked as Yoba, that uses fake GitHub projects and websites posing as new ChatGPT and Claude desktop applications. Victims searching for AI tools can be directed to convincing pages for supposed releases such as GPT-6 Astra and Claude Opus, then…
Attackers used fake Microsoft sign-in pages to capture already-authenticated Microsoft 365 sessions, then replayed those sessions to enter business accounts without passwords or new MFA prompts. The campaign affected 79 organizations and expanded access by registering rogue devices, changing MFA…
ICMacOS is a commercially sold Mac malware kit that uses fake websites to convince victims to paste a command into Terminal. The command installs malware and displays a fake macOS password prompt, putting browser credentials, cloud access, developer secrets, and cryptocurrency wallets at risk. The…
Three real malware campaigns targeted people in Brazil and Portugal with fake legal notices, invoice pages, and finance-themed documents. Victims were directed to scripts, installers, or an ISO file that abused trusted VLC, VMware, and Microsoft utilities to load malicious code. The most useful…
Researchers found that a malicious instruction file placed in a user’s Downloads folder can manipulate AI coding agents into installing malicious software or exposing account login tokens. In testing, OpenAI Codex followed the planted instructions more than 90% of the time, while a related attack…
Researchers stopped a real attack in which a malicious instruction file in a developer’s Downloads folder attempted to direct an AI coding agent to install known malware. The attack abuses the agent’s trust in local instruction files and can also alter agent settings to steal session tokens or make…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
