Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
Researchers uncovered a commercial phishing-kit-as-a-service called “Iron Man System” that lets criminals quickly deploy fake brand pages (postal/courier, toll fines, tax, banks, telecoms, loyalty programs) to steal victim data. The operation appears active and professionally maintained, with…
US authorities say North Korean operatives used stolen and fake identities to get hired into remote roles at more than 70 US companies, then operated company laptops from inside the US using “laptop farms.” Americans allegedly helped by receiving employer-issued laptops, keeping them online, and…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
Microsoft and partners disrupted a Chinese-language phishing kit ecosystem (tracked as Storm-2990) used to send over 1 billion malicious email and SMS messages to more than 75,000 organizations worldwide. The kits used common “urgent alert” scams (delivery issues, unpaid tolls, bank or tax…
Researchers describe a real Android banking-trojan operation (Hirudo) that tricks users into installing malware through fake in-app update prompts and fake Google Play-like pages pushed via social media ads. Once installed, it can steal credentials and take over the device, and it can even replace…
A wave of fake websites impersonates Calendly booking pages for “Meta Careers” job interviews. After victims select an interview time and complete a fake CAPTCHA, the site prompts them to log in to Facebook and then Google, capturing passwords and even two-factor authentication codes in real time.…
US authorities arrested two Americans accused of helping North Korean “fake IT workers” get hired remotely at US companies and route company laptops into US-based “laptop farms.” The scheme used stolen or fake identities and location-masking tools so overseas workers could appear to be working from…
North Korean-linked actors are using fake identities to get hired into remote IT roles, then leveraging that trusted access to steal data or attempt to deploy malware. The article describes real cases (including KnowBe4 and Netskope) and explains how the scheme scales using fabricated personas,…
A researcher found PortSwigger disabled a CSRF training lab after claiming Chrome updates made it unsolvable, then tested it themselves across multiple Chrome versions. Their proof-of-concept shows Chrome can still send “Lax-by-default” cookies in cross-site POST requests for ~120 seconds after a…
A researcher reported (and Microsoft patched) a Visual Studio/SSMS Copilot flaw where a trailing dot in a filename (e.g., "settings.json.") bypassed protections and let Copilot overwrite sensitive settings files. The write-up also shows an “indirect prompt injection” workflow where untrusted text…
U.S. authorities charged 14 people tied to a North Korea-backed scheme that used stolen or fake identities to get remote IT jobs at more than 70 U.S. companies and funnel about $3 million back to Pyongyang. The operation relied on “laptop farms” in the U.S. to keep employer-issued laptops online…
The FTC sued Dmitry Belkin and multiple companies accused of exploiting sextortion and romance-scam victims through deceptive websites and telemarketing. The complaint says the businesses promised to stop attacks and work with law enforcement, but instead used fear tactics, fabricated “evidence,”…
A real phishing campaign used a generic online event invitation to trick recipients into clicking RSVP/download links. Victims were sent through a fake CAPTCHA and invitation page, then prompted to download a ZIP containing a legitimate ConnectWise ScreenConnect installer abused as a remote access…
A real-world text message scam uses the recipient’s real name followed by a question mark to trigger an automatic reply like “Who’s this?”. The goal is to get the victim to engage so the scammer can steer the conversation toward information theft or a longer con (including investment fraud), or at…
Researchers report a real-world macOS malware operation (ICMacOS) being sold as a service and delivered through “ClickFix” social-engineering pages. Victims are pushed to copy/paste Terminal commands and then shown fake macOS system dialogs that trick them into entering their login password,…
Leaked internal files suggest the Luna Moth (Silent Ransom Group) operation used scripted phone-based impersonation to convince employees to grant remote access to their work computers. The leak indicates a coordinated two-person workflow, one attacker talks to the victim while another operates the…
This weekly threat bulletin highlights multiple real-world incidents and campaigns, including phishing operations aimed at tricking people into handing over credentials. One campaign targeted Taiwanese research organizations with event-invitation emails, QR codes, and fake Google login pages…
Researchers showed that several popular AI agent frameworks can be manipulated into executing attacker-controlled tool actions just by asking the model to repeat a tool call as text. In one detailed demo, the model refused the dangerous request in words, but the framework still executed the tool…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
