GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
A group of men in Lagos, Nigeria used a fake Instagram profile posing as an attractive young woman to build trust with 17-year-old Jordan DeMay. After exchanging messages and a purported nude image, Jordan sent an explicit photograph, exposing him to a sextortion scheme designed to pressure victims…
A real deepfake during Ireland’s 2025 presidential election falsely depicted candidate Catherine Connolly saying the election was cancelled, that she was withdrawing, and that her supporters should not vote. The UK Electoral Commission is developing a rapid detection system because similar false…
An Arup employee transferred $25 million to fraudulent accounts after joining a video call featuring deepfake impersonations of company executives. The case shows how realistic-looking executive impersonation can pressure employees into approving high-value payments, even when the request appears…
Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…
A Hong Kong employee at engineering firm Arup transferred about $25.6 million after joining a video conference where every other participant was a deepfake. The incident shows how convincing fake video identities can be used to pressure employees into approving high-value payments, and why…
This article describes a real and growing social-engineering technique called ClickFix, where attackers disguise malicious instructions as a familiar CAPTCHA or verification step. In one documented case, a fake free image-editing tool prompted victims to run code that installed malware designed to…
Researchers disclosed SearchLeak, a Microsoft 365 Copilot Enterprise vulnerability chain that reportedly let a single crafted-link click turn a user’s AI assistant into a tool for collecting and sending out sensitive data. The attack abused prompt injection and trusted Microsoft infrastructure,…
Attackers hijacked two official Irish police X/Twitter accounts and used the trusted accounts to promote a fake cryptocurrency airdrop. The posts directed followers to a link that could trick them into giving up cryptocurrency-wallet keys, allowing criminals to drain their funds.
Researchers documented a malware campaign that uses a fake business-proposal disk image to trick Windows users into opening a shortcut disguised as a Word document. The shortcut shows a legitimate-looking PDF while silently installing CikaBika Bot, which lets attackers control the device through…
Attackers are using short business emails that ask companies to provide a quote for an upcoming project. The messages imitate ordinary request-for-quotation (RFQ) activity, then direct recipients to credential-stealing pages. The tactic is especially risky because sales and procurement teams…
Attackers broke into the email account of a CDU Heilbronn district executive and used the trusted mailbox to send roughly 6,500 fake messages. The emails used an event invitation as a lure and directed recipients to a link for a supposed document, making this a credible internal-email phishing…
Nach einem Angriff auf einen Buchungsdienstleister für Tourismusbetriebe wurden Gästedaten zahlreicher Unterkünfte gestohlen. Die Täter nutzen Namen, Kontaktdaten und Buchungsnummern, um Urlauber mit glaubwürdigen Phishing-Nachrichten zur Herausgabe ihrer Kreditkartendaten zu verleiten.
Nach einem Sicherheitsvorfall beim Schweizer Online-Marktplatz Ricardo könnten Angreifer Namen, Adressen und Telefonnummern von rund 890.000 Konten für überzeugende Betrugsversuche nutzen. Parallel wurden WhatsApp-Nachrichten beobachtet, die sich als Ricardo-Kundendienst ausgaben und Nutzer auf…
A reported case involved a Virginia woman receiving hundreds of automated sign-up emails in a day. The flood was used to hide a legitimate bank alert about a fraudulent laptop purchase, showing how inbox overload can conceal account fraud or unauthorized transactions.
A Google Play app originally listed as a game rebranded itself as Google Chrome and reportedly accumulated more than 100,000 downloads. It copied Chrome’s name, icon, and store screenshots, and was reportedly shown in a sponsored search placement above the real Chrome app. The case shows that…
Scammers are exploiting fear from a recent Ledger-related spyware incident by sending emails that push a fake “firmware update.” The email urges recipients to connect their hardware wallet and click through to a realistic-looking “Genuine check” page with an “Update Now” button, risking theft if…
A tracked threat group (UAT-11985) sent tailored event-invitation lures to people tied to Taiwan research organizations, trying to trick them into “registering” through a fake Google Form flow. Victims who clicked a disguised link or scanned a tampered QR code were pushed to a convincing Google…
A real-world business email compromise-style fraud hit Italian bank Fideuram after criminals impersonated executives using WhatsApp and an AI-cloned voice on a follow-up call. Staff were persuaded to transfer funds to foreign accounts before the scam was discovered, showing how AI makes familiar…
Researchers observed a surge in short "request for quotation" (RFQ) emails that look like routine business inquiries to sales and procurement teams. After the victim replies, attackers send a follow-up link disguised as project documents or a procurement portal that leads to a fake Microsoft…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
