Loading story…
A major sportswear brand's legitimate email domain was compromised and used to launch a large-scale phishing campaign, as observed by KnowBe4 analysts. Attackers exploited the trust associated with the brand to send polymorphic phishing emails that bypassed traditional email defenses, employing advanced social engineering tactics and frequently changing payloads to evade detection. The campaign demonstrated how attackers can move laterally within an organization, extend their reach to additional victims, and continue impersonation efforts even after the initial compromise, highlighting the persistent threat to high-profile brands.
Recent research presented by Okta further underscores the ongoing risk posed by phishing attacks, revealing that even organizations with advanced security measures remain vulnerable. The study found that traditional defenses such as email gateways, endpoint protection, and user training are often insufficient to stop sophisticated phishing campaigns, with American enterprises and Office 365 users being particularly frequent targets. These findings illustrate the persistent and evolving nature of phishing threats, especially when attackers leverage compromised trusted domains to increase their success rates.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Okta analyzed 26 months of FastPass authentication logs and found that sophisticated phishing attacks continued to evade common enterprise controls such as email gateways, endpoint protection, and user training. The study also found American organizations and Office 365 were frequent targets, while phishing-resistant authentication adoption remained limited.
KnowBe4 Defend detected the phishing campaign leveraging the compromised sportswear brand domain and documented how attackers rapidly exploited a compromised business email account for broad abuse. The report highlighted the use of obfuscated payloads, varied subject lines, and trust in a legitimate domain to increase delivery and effectiveness.
Between October 29 and 30, 2025, attackers used the compromised domain of a major global sportswear brand to send polymorphic phishing emails that bypassed SPF, DKIM, DMARC, and secure email gateways. The campaign targeted organizations in 80 countries, used region-specific lures and credential-harvesting sites, and impersonated entities such as UK Visa and Immigration and Microsoft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have intensified their use of phishing campaigns by impersonating well-known brands and trusted online services to deceive victims and steal sensitive credentials. In one campaign identified by the Cofense Phishing Defense Center, attackers targeted individuals in social media and marketing roles by sending fake job application emails that appeared to originate from major companies such as Red Bull, Tesla, Google, and Ferrari. These emails used convincing language and branding, including up-to-date logos and tailored subdomains, to increase their legitimacy and lure recipients into clicking malicious links. The attackers further enhanced the credibility of their messages by spoofing the sender address to appear as if it came from a legitimate domain, such as Xero, which has been abused in previous phishing incidents. The phishing process often began with a CAPTCHA page to create a sense of security before redirecting victims to fraudulent login pages designed to harvest credentials. This approach demonstrates a sophisticated understanding of social engineering tactics and the value of resume and personal information in targeting specific job seekers. In a separate but similarly themed incident, a Malwarebytes employee was targeted by a phishing email that impersonated 1Password, a popular password manager. The email falsely claimed that the recipient's 1Password account had been compromised and urged immediate action, including changing the account password and enabling two-factor authentication. The message mimicked legitimate security alerts, referencing 1Password's Watchtower feature, but included subtle red flags such as a sender address not associated with 1Password and a malicious link disguised as a legitimate action button. The phishing link directed users to a typosquatted domain, onepass-word[.]com, rather than the official 1Password website. Interestingly, the email's 'Contact us' link routed through a legitimate support page but used a redirect service, further complicating detection. The use of Mandrillapp, a transactional email delivery service, added another layer of apparent legitimacy to the phishing attempt. Both campaigns highlight the increasing sophistication of phishing attacks, with threat actors leveraging trusted brands and services to bypass security filters and exploit user trust. The attackers' use of brand-specific subdomains, authentic-looking graphics, and familiar communication styles makes these phishing emails particularly convincing. By targeting individuals with tailored messages, such as job seekers or users of specific online services, the campaigns increase the likelihood of successful credential theft. The abuse of legitimate infrastructure, such as Xero's email services and Mandrillapp, demonstrates how attackers can exploit trusted platforms to evade detection. Security teams are advised to educate users about the signs of phishing, including checking sender addresses, scrutinizing URLs, and being wary of urgent requests for sensitive information. Organizations should also monitor for abuse of their brand in phishing campaigns and work with email providers to block malicious domains. The incidents underscore the need for robust email security solutions and ongoing vigilance against evolving social engineering tactics. As phishing campaigns continue to evolve, both individuals and organizations must remain alert to the latest techniques used by cybercriminals to compromise accounts and steal valuable data.
Jun 29, 2026
SOCRadar reported a long-running phishing operation dubbed **Operation DoppelBrand**, attributed to a financially motivated actor tracked as **GS7**, that uses high-fidelity replicas of Fortune 500 and major consumer brands to harvest credentials and enable follow-on access. The activity observed most recently (Dec 2025–Jan 2026) impersonated major financial and technology organizations (including **Wells Fargo, USAA, Navy Federal Credit Union, Fidelity, Microsoft, and Citibank**) and relied on a highly automated domain and infrastructure pipeline, with researchers identifying **hundreds of malicious domains** and **150+ newly identified domains** following consistent patterns. The operation is assessed as monetization-focused, with GS7 linked to trading stolen credentials and access in underground markets and using **Telegram bots** for credential handling/exfiltration; reporting also notes abuse of legitimate remote management tooling to help establish persistence after credential capture. Dark Reading’s coverage of the SOCRadar findings emphasized the campaign’s effectiveness stemming from near-perfect portal impersonation and rapid infrastructure rotation, increasing the likelihood of successful credential theft against both enterprises and their customers. For defenders, the reporting highlights the need to treat this as an ongoing, scalable credential-harvesting and initial-access operation: prioritize monitoring for lookalike domains and brand-abuse infrastructure, strengthen anti-phishing controls around customer/employee authentication flows, and review remote management tool governance to reduce the impact of stolen credentials being converted into durable access.
Jun 29, 2026
Threat actors have intensified phishing operations by leveraging complex email routing techniques and exploiting domain misconfigurations to successfully spoof trusted brands. These campaigns manipulate email infrastructure weaknesses, allowing attackers to send convincing phishing emails that appear to originate from legitimate domains, thereby increasing the likelihood of user engagement and credential compromise. Security researchers have observed that such tactics are being used to bypass traditional email security controls, making detection and prevention more challenging for organizations. During the holiday season, attackers combined these advanced spoofing methods with social engineering, sending emails that mimic Docusign notifications and Christmas-themed documents to exploit user trust and seasonal distractions. Victims are redirected through multiple hosting platforms before landing on credential harvesting sites, and a secondary wave of attacks targets personal financial data through fake loan application forms. The campaigns demonstrate a sophisticated use of both technical and psychological tactics to maximize the impact on both corporate and individual targets.
Jun 29, 2026