U.S. authorities charged 14 people tied to a North Korea-backed scheme that used stolen or fake identities to get remote IT jobs at more than 70 U.S. companies and funnel about $3 million back to Pyongyang. The operation relied on “laptop farms” in the U.S. to keep employer-issued laptops online…
Researchers report a real-world macOS malware operation (ICMacOS) being sold as a service and delivered through “ClickFix” social-engineering pages. Victims are pushed to copy/paste Terminal commands and then shown fake macOS system dialogs that trick them into entering their login password,…
Silent Ransom Group allegedly extorted law firms by using phone calls and social engineering to trick employees into giving access or uploading sensitive files, without encrypting data. Leaked internal chats suggest 27 law firms paid roughly $207M in a six‑month span, with individual payments…
Leaked chat logs linked to the Silent Ransom Group describe efforts to pressure U.S. law firms through extortion and, unusually, by sending in-person “agents” to physically enter offices and copy data. The FBI previously warned that people tied to the group were posing as IT staff to gain access,…
Cisco Talos observed an APT spear-phishing campaign targeting people affiliated with Taiwan research organizations using credible-looking public event invitations. Attackers impersonated well-known academic/policy institutions, used mismatched “safe-looking” registration links, and in some cases…
The article describes a real phishing investigation where attackers used an adversary-in-the-middle (AiTM) proxy to relay a genuine Microsoft sign-in and steal both credentials and the victim’s live session token. The lure came from a legitimately compromised corporate mailbox, making common email…
Researchers found a real phishing operation that pretends to offer AI marketing tools (e.g., “Muse Ads”) and prompts users to click “Connect” to log in. The login pop-up looks like Google or Okta, but it’s a fake browser window embedded inside the webpage, designed to steal passwords and MFA codes,…
Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…
This weekly bulletin highlights multiple real-world incidents, including phishing and impersonation campaigns. Notably, researchers found attackers using malicious “Custom GPTs” on ChatGPT to redirect victims to a Google Sites page and trick them into running commands that install remote-access…
Huntress reports attackers are increasingly installing legitimate remote monitoring and management (RMM) tools after a phishing click, giving them persistent remote control that can blend in with normal IT activity. The article also describes common identity-focused schemes like hidden mailbox…
China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…
Attackers are using sponsored Google ads to route people to a malicious “custom GPT” that looks like ChatGPT, even while the user is logged in on the real ChatGPT domain. The fake GPT displays a convincing “service availability” message and pushes a link to a “backup domain” that ultimately…
Proofpoint linked China-nexus actor TA419 to credential-phishing campaigns aimed at U.S. AI policy experts, including people at think tanks. The attacker impersonated well-known AI policymakers and an Anthropic executive, using believable “advisory committee” and “research questions” emails to draw…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
A China-aligned group (TA419) targeted US AI policy experts by impersonating well-known AI and policy figures and sending friendly “collaboration” emails. If the target engaged, the attackers redirected them through multiple URLs to a fake Microsoft login pop-up designed to steal Microsoft 365…
A China-aligned espionage group (TA419) targeted U.S. AI policy experts by impersonating well-known public figures and sending credible policy-related invitations. After victims replied, the attackers sent shortened links that led to a fake OneDrive login designed to capture passwords, MFA codes,…
Proofpoint reports a China-aligned espionage group (TA419) targeted U.S. AI policy experts at think tanks, universities, and law firms using phishing emails that impersonated well-known officials and AI industry figures. The attackers tried to start a conversation first, then sent a shortened link…
A China-aligned group (tracked as TA419) impersonated real AI policy figures and sent benign-sounding outreach to people working on AI policy at US and Japanese organizations. Once targets replied, the attackers sent a shortened link that ultimately led to a fake OneDrive/Microsoft 365 login page…
The article describes how real-world attackers are shifting common breach activity into the web browser, including phishing that steals live sessions, fake “copy/paste to fix” prompts (ClickFix), and OAuth consent/device-code tricks. It highlights how these browser-based lures can bypass MFA and…
Researchers found a real malware campaign where attackers abused ChatGPT “CustomGPTs” and Google sponsored search results to funnel victims to a fake ChatGPT experience. Victims are shown a fake “Service Availability Notice” and pushed to a “backup domain” that looks like a Cloudflare CAPTCHA,…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
