Operation Mirror Mask

AI · LINUX · difficulty 2 · ~18 min · 10 steps

A cloned voice talked your help desk into resetting an executive's MFA.

Briefing

At 16:40 the help desk reset MFA for the CFO's account 'at her urgent request' over the phone. The CFO was on a flight with no signal. The voice on the call was an AI clone built from her conference-talk recordings. Minutes later the account signed in from a new device and started pulling finance files. Voice is no longer proof of identity. Trace the reset, kill the attacker's session with the Azure CLI, and restore the account.

Objectives

Return to the range lobby

THREAT FEED ▲ lateral movement via wmiexec up 18% ▲ new loader family 'GHOSTPULSE' staging via DLL search-order hijack ▲ prompt injection in support queues now routine ▲ cron persistence campaign targeting exposed SSH ▲ poisoned model weights on public hubs ▲ remember: trust nothing, hash everything ▲
operator@dojo:~$