Loading story…
IBM Security X-Force reported a global spear-phishing campaign targeting organizations involved in the COVID-19 vaccine cold chain, using emails that impersonated a Haier Biomedical executive and malicious HTML attachments themed as requests for quotation to steal credentials. The activity began in September 2020 and hit entities in at least six countries, including the European Commission’s Directorate-General for Taxation and Customs Union, with IBM assessing that the operation was likely intended to support follow-on unauthorized access and cyber espionage tied to vaccine distribution.
Subsequent reporting indicated the targeting extended across Europe, Asia, North America, and South America, affecting transportation, health care, information technology, electronics, refrigeration, manufacturing, and government organizations. IBM said the campaign showed precision targeting of individuals involved in import/export, transport, and public health, while victims included automotive, aviation, maritime, biomedical research, pharmaceutical, software, web-hosting, and outsourcing organizations; DHS CISA separately warned vaccine storage and transport entities to remain vigilant.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
IBM assessed that a global spear-phishing campaign began in September 2020 against organizations associated with the COVID-19 vaccine cold chain. The operation used emails impersonating a Haier Biomedical executive and RFQ-themed malicious HTML attachments to harvest credentials.
The X-Force Threat Intelligence Index 2021 reported that industries heavily relied upon for COVID-19 response efforts were at the epicenter of targeting during 2020, and that attacks on manufacturing, energy, and health care doubled from the previous year.
IBM noted that Gavi, UNICEF, and other partners launched the Cold Chain Equipment Optimization Platform (CCEOP), which later became relevant to the phishing lures used in the campaign.
IBM released indicators of compromise for the campaign, including malicious HTML attachment naming patterns, SHA-256 hashes, credential-harvesting and C2 URLs, and related DNS contact addresses and domains.
DHS CISA issued an alert in conjunction with IBM's research, urging vaccine storage and transport organizations to review the findings and recommended security practices.
After uncovering the operation, IBM said it followed responsible disclosure protocols and notified appropriate entities and authorities. IBM assessed the activity was likely intended to enable follow-on unauthorized access and possible cyber espionage, though it could not firmly attribute the campaign.
IBM later reported likely targeting of additional organizations connected to the COVID-19 supply chain across Europe, Asia, North America, and South America, including transportation, health care, IT and electronics, refrigeration, metal manufacturing, and European government entities. The activity included precision targeting of specific individuals in ministries and departments involved in transport, import/export, and public health functions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 77 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
ibm.com
Open sourcesecurityintelligence.com
Open sourcesecurityintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malicious actors launched **COVID-19-themed phishing campaigns** against government agencies and medical organizations, using pandemic-related lures to exploit heightened public concern and operational urgency. The activity was documented by Palo Alto Networks Unit 42, which reported that attackers tailored messages around coronavirus developments to increase the likelihood that recipients would open emails, click links, or interact with malicious attachments. The targeting of public-sector and healthcare entities highlighted the risk that threat actors would use a global health crisis to gain access to sensitive networks and data. By impersonating trusted pandemic-related communications and leveraging the demand for timely information, the campaigns sought to compromise organizations that were already under significant pressure responding to the outbreak.
Jul 12, 2026
Cybercriminals rapidly adopted coronavirus as a global social-engineering lure, using pandemic-themed emails to drive **business email compromise**, credential phishing, malware delivery, and large-scale spam across multiple countries and sectors. Proofpoint reported campaigns targeting organizations in Italy, the Czech Republic, the United States, Canada, Australia, and Turkey, as well as industries including healthcare, education, manufacturing, media, advertising, and hospitality. Attackers frequently impersonated trusted public-health institutions such as the **WHO**, **CDC**, and national health agencies to make messages appear legitimate and increase click-through rates. The activity included highly tailored phishing against healthcare firms, fake employee surveys designed to steal **OWA** credentials, and region-specific lures written in local languages, including Italian. Proofpoint linked portions of the activity to known threat actors including **TA505**, **TA542**, and **TA564**, and observed malware families such as `Ostap`, `The Trick banker`, `Get2`, `SDBbot`, `Ursnif`, `GuLoader`, `Agent Tesla`, and `Remcos`. The report found that coronavirus had become a near-universal pretext for cybercrime, enabling both opportunistic and targeted attacks at global scale.
Aug 14, 2026
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026