Loading story…
A large-scale credential phishing operation impersonated Amazon Japan and sent hundreds of thousands to more than one million messages per day, using Japanese-language lures about account ownership, payment updates, and account locks to drive victims to spoofed login pages. The campaign harvested credentials, personally identifiable information, and payment card data, and initially used geofencing so users in Japan saw the fake pages while users elsewhere were redirected to the legitimate Amazon Japan site. Researchers linked the activity through reused infrastructure including IP-based landing pages and .xyz and .cn domains, with the scale and persistence suggesting possible botnet-driven delivery.
Separately, Facebook disclosed legal action against an account takeover scheme in which attackers posed a malicious Android app, "Ad Manager for Facebook," as a legitimate tool for advertising and marketing agency staff. The app stole credentials and enabled session or cookie hijacking, allowing the operators to seize Facebook accounts and run unauthorized advertisements, including scam promotions, causing losses reported at more than $16 million and previously described as over $36 million in unauthorized ads. Facebook said it removed the app from Google Play and other sources, refunded affected victims, and worked to secure compromised accounts.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Facebook announced legal actions on June 29, 2021 against two separate schemes: a bait-and-switch advertising operation and a Vietnam-linked account takeover operation. In the latter case, attackers allegedly used a malicious Android app called "Ad Manager for Facebook" to steal credentials and hijack sessions for ad fraud.
Proofpoint observed daily message volume sometimes exceeding one million messages by mid-October 2020. It assessed that the campaign's scale, persistence, and lack of weekend slowdown suggested possible botnet involvement.
By early October 2020, the phishing actor had improved sender-address masquerading, using addresses that more closely resembled Amazon branding. Proofpoint also observed October message volumes averaging 750,000 per day to date.
Proofpoint measured average daily message volume for the campaign at 424,000 during September 2020. The operation reused infrastructure and continued harvesting credentials, PII, and credit card data.
Proofpoint tracked sustained, high-volume Amazon Japan phishing campaigns from August 2020, targeting organizations in Japan or with a presence there. The geofenced landing pages showed fake Amazon Japan pages to users in Japan while redirecting others to the legitimate site.
Proofpoint said related Amazon Japan credential-phishing activity dated back to June 2020. The operation impersonated Amazon Japan and used spoofed login pages to harvest credentials and other victim data.
A December 30, 2021 update said unauthorized ads tied to the Vietnam-based account takeover operation resulted in over $16 million in losses. The original June 2021 post had said the group ran over $36 million in unauthorized ads.
A June 30, 2021 update stated that the Amazon Japan phishing activity was still ongoing. Proofpoint said the operation no longer relied on geofencing at that point.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two large phishing operations that abused trusted platforms to improve delivery and evade defenses. Guardio said the **AccountDumpling** campaign used Google AppSheet to send emails from legitimate Google infrastructure while impersonating **Meta Support** and recruiters, luring Facebook Business users with fake account disablement notices, copyright complaints, and job offers. The operation compromised about **30,000 Facebook accounts** across roughly **50 countries**, stealing credentials, `2FA` codes, personal data, and government ID images; the stolen information was often funneled through Telegram channels, and the hijacked accounts were later sold or monetized through fraudulent advertising and scams. Evidence in generated PDF metadata linked the activity to Vietnam-based operators, including an individual identified as **PHẠM TÀI TÂN**. Microsoft separately disclosed an adversary-in-the-middle phishing campaign that used fake workplace compliance notices to target more than **35,000 users** at **13,000 organizations** in **26 countries**, with most activity concentrated in the United States. Attackers posed as internal HR and compliance teams, sent urgent messages with attached PDFs, and pushed victims through redirects, CAPTCHA checks, and a counterfeit Microsoft sign-in page designed to steal session tokens rather than just passwords, allowing account access without the victim's second factor. The incidents show how attackers are increasingly relying on legitimate cloud services and convincing enterprise-themed lures to bypass spam controls, defeat traditional authentication protections, and accelerate account takeover at scale.
Jun 29, 2026
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026
Threat researchers reported multiple financially motivated social-engineering operations designed to steal credentials and enable downstream fraud. Malwarebytes documented a **job-themed phishing** campaign impersonating *Google Forms* via the lookalike domain `forms.google.ss-o[.]com`, using a `generation_form.php` script to generate personalized lure URLs and redirecting victims through a fake form to a credential-harvesting login flow (e.g., `id-v4[.]com`). The infrastructure also used redirection to local Google search pages as an anti-analysis tactic to reduce link sharing and researcher visibility. Separately, Bridewell-reported activity described a **Booking.com-themed, multi-stage phishing and fraud scheme** targeting both hotel partners and guests: initial “complaint”/reservation lures drive staff to attacker-controlled portals using lookalike domains (including **IDN homograph** tricks) to harvest partner credentials, followed by account takeover and guest-facing fraud (including WhatsApp outreach using real booking details). A third report described the broader rise of **Carding-as-a-Service (CaaS)** marketplaces (e.g., “fullz” bundling and platforms such as Findsome and UltimateShop) and the supply chain feeding them (PhaaS credential theft, skimming, and malware), but it did not describe the same specific phishing incidents and should be treated as related background rather than part of the same event.
Jun 29, 2026