Loading story…
Finance-focused phishing campaigns are increasingly using routine, process-oriented business language to impersonate legitimate workflows such as invoices, remittances, contracts, procurement notices, settlements, and payment confirmations. Reporting based on Cofense Intelligence data from Q1 2025 through Q1 2026 says operationally styled subject lines rose to dominate these attacks, reaching 79% in Q1 2026, as threat actors moved away from overtly urgent wording that is more easily recognized by users and filtered by email defenses.
The campaigns primarily target finance teams and financial organizations, where staff regularly handle large volumes of repetitive external email and are therefore more exposed to convincing administrative lures. The most common themes include new business opportunities, contracts in progress, and payment-related messages, including revised bank details and invoice notices, with attackers using them to drive credential theft, malicious attachment opens, and link clicks while blending into normal business communications.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Cofense Intelligence data covering Q1 2025 through Q1 2026 found that process-oriented finance phishing language increasingly dominated these campaigns, reaching 79% in Q1 2026 compared with 21% for traditional urgency-based tactics. The report describes attackers shifting to routine business language tied to invoices, remittances, contracts, procurement, and settlements.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly leveraging trusted business communication channels, such as company email accounts and professional networking platforms, to conduct sophisticated phishing attacks. By compromising legitimate email accounts, attackers can bypass authentication mechanisms like DMARC and remove typical signs of phishing, making it difficult for both security systems and individuals to detect malicious messages. These tactics often involve impersonation of trusted contacts or brands, exploiting pre-existing relationships or establishing new ones to socially engineer targets into divulging sensitive information. A recent campaign specifically targeted finance executives on LinkedIn with direct messages impersonating invitations to join an executive board for a fictitious investment fund. The phishing messages included malicious links that redirected victims through a series of sites, ultimately leading to a fake "LinkedIn Cloud Share" portal designed to steal Microsoft credentials. Attackers used domains such as `payrails-canaccord[.]icu` and `boardproposalmeet[.]com` and hosted their final phishing pages on Firebase, further increasing the credibility of the attack. These incidents highlight the evolving sophistication of phishing campaigns and the need for heightened vigilance among organizations and their executives.
Jun 29, 2026
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
Threat actors have intensified their use of phishing campaigns by impersonating well-known brands and trusted online services to deceive victims and steal sensitive credentials. In one campaign identified by the Cofense Phishing Defense Center, attackers targeted individuals in social media and marketing roles by sending fake job application emails that appeared to originate from major companies such as Red Bull, Tesla, Google, and Ferrari. These emails used convincing language and branding, including up-to-date logos and tailored subdomains, to increase their legitimacy and lure recipients into clicking malicious links. The attackers further enhanced the credibility of their messages by spoofing the sender address to appear as if it came from a legitimate domain, such as Xero, which has been abused in previous phishing incidents. The phishing process often began with a CAPTCHA page to create a sense of security before redirecting victims to fraudulent login pages designed to harvest credentials. This approach demonstrates a sophisticated understanding of social engineering tactics and the value of resume and personal information in targeting specific job seekers. In a separate but similarly themed incident, a Malwarebytes employee was targeted by a phishing email that impersonated 1Password, a popular password manager. The email falsely claimed that the recipient's 1Password account had been compromised and urged immediate action, including changing the account password and enabling two-factor authentication. The message mimicked legitimate security alerts, referencing 1Password's Watchtower feature, but included subtle red flags such as a sender address not associated with 1Password and a malicious link disguised as a legitimate action button. The phishing link directed users to a typosquatted domain, onepass-word[.]com, rather than the official 1Password website. Interestingly, the email's 'Contact us' link routed through a legitimate support page but used a redirect service, further complicating detection. The use of Mandrillapp, a transactional email delivery service, added another layer of apparent legitimacy to the phishing attempt. Both campaigns highlight the increasing sophistication of phishing attacks, with threat actors leveraging trusted brands and services to bypass security filters and exploit user trust. The attackers' use of brand-specific subdomains, authentic-looking graphics, and familiar communication styles makes these phishing emails particularly convincing. By targeting individuals with tailored messages, such as job seekers or users of specific online services, the campaigns increase the likelihood of successful credential theft. The abuse of legitimate infrastructure, such as Xero's email services and Mandrillapp, demonstrates how attackers can exploit trusted platforms to evade detection. Security teams are advised to educate users about the signs of phishing, including checking sender addresses, scrutinizing URLs, and being wary of urgent requests for sensitive information. Organizations should also monitor for abuse of their brand in phishing campaigns and work with email providers to block malicious domains. The incidents underscore the need for robust email security solutions and ongoing vigilance against evolving social engineering tactics. As phishing campaigns continue to evolve, both individuals and organizations must remain alert to the latest techniques used by cybercriminals to compromise accounts and steal valuable data.
Jun 29, 2026