Attacks targeting software companies, SaaS platforms, and internet services, including the vendor impersonations aimed at their customers. Each entry is broken down with an original video explainer, key findings, and the red flags your team should watch for. How we produce these.
U.S. prosecutors charged three people with allegedly using AI-generated CEO and attorney impersonations to steal about $129 million from companies worldwide. The group reportedly emailed accounting teams about confidential transactions, used AI voice and video calls to reinforce the request, and…
Attackers linked to North Korea used a fake recruiting process to trick a Binance engineer into downloading a coding assignment onto a work computer. The malicious assignment gave the attackers a foothold, which they expanded through an internal AI tool and privileged engineering access to carry…
Researchers found and responsibly disclosed a now-patched ChatGPT weakness that could let malicious content escape Lockdown Mode protections. An attacker could use a crafted prompt, malicious custom GPT, or shared chat to steal chat data without interaction or show a convincing fake ChatGPT update…
The newsletter reports that Binance attributed a record-setting $6.43 billion theft to a sophisticated, multi-stage campaign. Attackers reportedly used recruitment-themed social engineering against two engineers and a tampered Homebrew installation, showing how a convincing job-interview pretext…
Check Point Research found and reported a ChatGPT vulnerability that could let malicious content escape a protected preview environment, bypassing Lockdown Mode. The flaw could support fake ChatGPT update windows, credential-harvesting reauthentication pages, malware downloads, and, in the Classic…
Researchers demonstrated that a malicious or hijacked browser extension can use a logged-in Claude web session to send instructions to Claude Desktop and run commands on a computer. The proof of concept repeatedly pressured the AI agent to install a malicious npm package, while automated clicks…
North Korean operatives reportedly posed as remote IT workers, used stolen identities, passed hiring checks, and gained legitimate access inside hundreds of Western companies. The article also describes attackers using autonomous AI agents inside a victim’s cloud environment to harvest credentials…
Russia-linked Midnight Blizzard compromised and cloned trusted websites to silently target iPhone and Android visitors in Europe and the United States. The campaign used watering-hole websites and a compromised web analytics service to profile devices and deliver exploit chains that could steal…
Attackers linked to North Korea reportedly used fake recruitment interviews to trick Binance engineers into downloading malicious software. They then used a compromised engineer laptop and access to an internal AI tool to take over employee wallets and steal $6.3 billion in cryptocurrency.
The article describes active campaigns that use familiar business documents, trusted file-sharing services, AI brands, and Microsoft sign-in flows to trick employees into granting account access. The most actionable patterns are phishing emails and document links that lead victims to Microsoft…
Attackers reportedly used a fake job opportunity to trick a Binance software engineer into running a coding assignment on a work computer. The assignment installed malicious software, helping the attackers move through Binance systems and ultimately steal about $6.3 billion in cryptocurrency. The…
A real developer-targeted campaign used a fake “Google Update Support” extension hidden in weaponized code repositories. Victims were lured with a paid, no-coding-needed request to review a project in Cursor; opening the repository could trigger installation of an extension that collected browser,…
Researchers found a fake Apple Cash reward page that promises $750 after a supposed device verification. Instead of paying users, it pushes them through affiliate links to install apps, create accounts, and play games while using fake verification steps and countdown pressure. The page is not…
Attackers reportedly spent months targeting Binance engineers, using a tampered software installer and fake job interviews with a malicious technical assignment. After gaining access through employee devices and credentials, they abused internal systems to authorize transfers from Binance hot…
Attackers gained access to The Kyiv Independent’s website management and newsletter distribution systems, then used those trusted channels to send false crisis alerts and publish fake news. The messages falsely alleged nuclear and physical attacks involving President Volodymyr Zelensky, apparently…
Microsoft observed a real campaign using fake download pages and trojanized installers promoted as cracked software, games, plugins, and utilities. Victims who run the downloads can unknowingly install proxy software, distributed-computing tools, and adware-style monetization components that…
Binance says attackers used fake job-related downloads and a trojanized installer for a popular AI tool to compromise members of its wallet infrastructure team. The campaign ultimately gave the attackers access to an internal wallet-signing service and enabled a $6.43 billion theft outside the…
Attackers linked to North Korea reportedly used a fake recruiting process to trick a Binance software engineer into downloading and running a malicious code repository during a supposed job assessment. The compromise ultimately helped the attackers access Binance’s wallet systems and steal about…
Binance says a North Korea-linked group spent months compromising wallet engineers before stealing $6.34 billion in cryptocurrency. One engineer was drawn into a fake recruiting process, built trust with a supposed HR representative and CEO, then downloaded a malicious coding assignment onto a work…
Attackers reportedly used a fake recruiting process to target Binance software engineers over several months. They built trust through a legitimate job platform and a fake HR interview, then persuaded an engineer to download a malicious coding assignment onto a work computer. That access was later…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
