Loading story…
Researchers disclosed a long-running fraud operation that has impersonated major Russian companies since at least 2017, using cloned corporate websites, phishing emails, and cold calls to trick international businesses into paying in advance for nonexistent goods and services. The campaign has primarily targeted B2B trade customers in CIS countries, but the fake sites were also built to reach a wider audience with Russian, English, French, and Arabic content. Attackers posed as firms in sectors including manufacturing, logistics, and banking, then sent forged contracts, invoices, and other business documents containing fraudulent banking details.
Investigators linked nearly 100 counterfeit domains to the scheme through shared DNS records, registration patterns, and infrastructure including IP addresses 212.127.73[.]235 and 167.86.100[.]68. The fraudulent sites copied legitimate company branding and content, and in some cases even reproduced anti-fraud warnings from the real firms to appear credible. Researchers said newer domains increasingly used .com, .org, and .net rather than .ru, while stolen funds were routed to shell-company bank accounts. In one documented case, an Azerbaijani company reportedly lost $150,000 in April 2025 after sending payment to the scammers.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
In April 2025, an Azerbaijani company reportedly sent a $150,000 advance payment to the fraudsters after being deceived by the impersonation scheme.
Researchers said the impersonation and advance-payment fraud operation has been active since 2017, using cloned websites, phishing emails, and cold calls to target international businesses, especially in CIS countries.
Researchers disclosed that they had connected nearly 100 fake domains to the campaign through shared infrastructure such as DNS records, registration data, and IP addresses, revealing the scale of the operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian-speaking threat actors have orchestrated a large-scale phishing campaign targeting the hospitality industry by registering over 4,300 domains that impersonate well-known travel and booking platforms such as Booking.com, Expedia, Agoda, and Airbnb. The campaign, active since at least February 2025, uses spam emails to lure hotel guests into clicking on links that redirect them to sophisticated fake websites. These sites are designed to appear legitimate, supporting 43 languages and employing brand logos, fake CAPTCHA checks, and customizations based on unique URL strings to increase credibility. Victims are prompted to enter their credit card details under the guise of confirming or paying for hotel reservations, with the sites even simulating 3D Secure verification processes to further the deception. Analysis by Netcraft and security researchers has linked the campaign to Russian threat actors, citing language artifacts in source code and debugger output. The phishing infrastructure is highly organized, with domain names following consistent patterns such as "confirmation," "booking," and "reservation" to enhance the illusion of authenticity. The campaign's scale and technical sophistication pose a significant threat to travelers and the hospitality sector, with the potential for widespread theft of payment data and personal information. Security experts recommend heightened vigilance for unsolicited travel-related emails and verification of booking communications through official channels.
Jul 12, 2026
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026
SOCRadar reported a long-running phishing operation dubbed **Operation DoppelBrand**, attributed to a financially motivated actor tracked as **GS7**, that uses high-fidelity replicas of Fortune 500 and major consumer brands to harvest credentials and enable follow-on access. The activity observed most recently (Dec 2025–Jan 2026) impersonated major financial and technology organizations (including **Wells Fargo, USAA, Navy Federal Credit Union, Fidelity, Microsoft, and Citibank**) and relied on a highly automated domain and infrastructure pipeline, with researchers identifying **hundreds of malicious domains** and **150+ newly identified domains** following consistent patterns. The operation is assessed as monetization-focused, with GS7 linked to trading stolen credentials and access in underground markets and using **Telegram bots** for credential handling/exfiltration; reporting also notes abuse of legitimate remote management tooling to help establish persistence after credential capture. Dark Reading’s coverage of the SOCRadar findings emphasized the campaign’s effectiveness stemming from near-perfect portal impersonation and rapid infrastructure rotation, increasing the likelihood of successful credential theft against both enterprises and their customers. For defenders, the reporting highlights the need to treat this as an ongoing, scalable credential-harvesting and initial-access operation: prioritize monitoring for lookalike domains and brand-abuse infrastructure, strengthen anti-phishing controls around customer/employee authentication flows, and review remote management tool governance to reduce the impact of stolen credentials being converted into durable access.
Jun 29, 2026