The article describes real supply-chain campaigns where attackers hid credential-stealing code inside trusted open-source packages and developer tools. When a developer or CI system installed the package, the malware ran immediately, stole cloud and pipeline credentials, and enabled unauthorized…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
A malicious Google Ads campaign showed convincing “computer locked/infected” warnings to Windows and Mac users and pressured them to call fake tech-support numbers. The goal was to confuse people into paying for bogus support, sharing personal information, or allowing remote access, not to actually…
Scammers convinced DYORSWAP to integrate a fake version of the upcoming GIWA blockchain, making it look legitimate to users. More than 1,300 wallets then sent roughly 767 ETH (about $2M) to a spoofed bridge contract, which was quickly drained and routed through Tornado Cash.
Threat groups are actively targeting healthcare and pharma staff using phone-based social engineering (“vishing”) and look‑alike medical domains to steal employee login credentials. Researchers say attackers pressure employees to click password-reset or MFA-reset links, and multiple…
Attackers compromised legitimate Ukrainian websites and showed visitors a fake CAPTCHA/Cloudflare-style “verification” prompt to trick them into installing malware. The infection chain drops Lunex (aka Psychedelic Stealer), which disables security monitoring using a vulnerable AMD driver and then…
Criminals in parts of Europe have been mailing fake “replacement” bank cards or letters claiming a card is expiring, pushing victims to scan a QR code or visit a URL to “activate” the card. The QR code redirects to a fake banking site that harvests login and account details, potentially giving…
A U.S. Army soldier ("Kiberphant0m") tied to major telecom data thefts was sentenced to 70 months in prison. Prosecutors say that while jailed, he used other inmates’ email accounts to get someone on the outside to ask commercial AI tools for vulnerability details and even “real world working”…
Researchers spotted a Telegram job ad recruiting callers to impersonate the “Google Account Security Team” and run voice-phishing calls. The ad absurdly claimed “NO SCRIPT READING” while also publishing the exact phone script to use, showing a repeatable, real-world vishing workflow.
Researchers reported a critical issue in Microsoft’s DebugMCP (v1.1.4) where a developer could be tricked into visiting a malicious webpage and end up with attacker code running on their machine. The attack abuses a locally running, unauthenticated server on port 3001 plus DNS rebinding to send a…
A new Android banking trojan called RemControl is being distributed through fake Google Play pages pretending to offer the TVTap IPTV app. After victims install it and grant powerful Accessibility permissions, it can place fake login screens over real banking apps and give attackers remote control…
Researchers report a new PamStealer variant that lures macOS users to a fake cryptocurrency wallet website and tricks them into running a script-based installer. The malware downloads a decryption tool and relies on a live server key exchange, making the real payload harder to analyze and helping…
Attackers compromised real Ukrainian business websites and showed visitors a fake Cloudflare verification page. The lure tricks people into running a Windows Installer command (via Windows+R), which installs “Psychedelic Stealer” to steal saved browser passwords and cryptocurrency wallet data.
An unknown group suspected to be North Korean state hackers targeted Rust language team members and high-profile package (“crate”) maintainers with phishing that lures victims into a fake conference call. When the victim tries to join, they are told they must install a “video codec” or update…
Attackers registered a long-used “placeholder” domain (third-party[.]com) that appears in developer documentation and code examples, then used it to trick Windows visitors with a fake Cloudflare-style verification page. The site tries to convince people to open the Windows Run box and paste a…
Microsoft says it disrupted “EvilTokens,” an AI-powered phishing-as-a-service operation used to break into email accounts at scale. The service automated device-code login phishing end-to-end, helping criminals steal authentication tokens and enable business email compromise across more than 10,000…
The article describes a common fraud pattern where scammers impersonate police, government officials, or other trusted authorities over the phone to pressure victims into paying via a Bitcoin/crypto ATM. The victim is told their money is at risk, instructed to withdraw cash, and then directed to…
Researchers say three “SalesBleed” flaws in Salesforce Agentforce could let attackers plant malicious instructions inside a Web-to-Lead form submission that later causes an Agentforce agent to leak CRM data or post phishing in Slack. The attack can stay hidden until an employee asks Agentforce to…
Researchers say a new Android banking trojan (“RemControl”) tricks people into installing a fake TVTap app update from spoofed Google Play-style pages. Once installed, it persuades victims to grant Accessibility permissions, giving attackers remote control and enabling theft of banking credentials…
Researchers tracked a live phishing flow that used 10 newly-registered “disposable” domains as entry points that redirected visitors to a fake AliExpress-themed site. The end site impersonated a shopping-assistant brand and pushed a browser extension, putting users at risk of credential and payment…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
