Loading story…
Researchers uncovered Phantom Deal, an M&A-themed business-email-compromise and advance-payment fraud campaign that impersonates executives and advisers to manufacture confidential acquisition transactions. In an attempted theft targeting Gen Digital's legal team, operators used WhatsApp, personal email, realistic corporate details, and a forged PwC-branded non-disclosure agreement to pressure Avast Software s.r.o. into wiring €626,735.45 to a Hong Kong company. The targeted employee identified an inconsistency in the impersonator's voice and did not send funds.
The attackers sought to isolate the employee from normal corporate channels, weaponizing deal secrecy to bypass legal, finance, treasury, compliance, and corporate-development review. During a controlled engagement, Gen researchers recorded repeated accesses to a canary-linked false payment confirmation; the fraudsters also requested SWIFT MT103 and UETR payment-tracking details. Analysis linked the operation to four additional targets and a reusable toolkit using PwC, KPMG, and Ogier branding, although investigators found no evidence that those firms were compromised or involved. Organizations should require independent out-of-band verification for executive-directed payments and confidential transaction requests.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
NortonLifeLock completed its acquisition of Avast in 2022, resulting in Gen Digital. Phantom Deal operators later referenced this real transaction to support their fabricated acquisition narrative.
Researchers matched document structure, language, and embedded identifiers to identify four additional people targeted with related fraudulent NDAs. The samples reused a suspected M&A-fraud package while varying names, dates, transaction details, and PwC, KPMG, or Ogier branding; Gen found no evidence those firms were compromised or involved.
After the scam was identified, the targeted employee and Gen researchers conducted a controlled exchange, supplying a fake account statement and a Citibank-style payment confirmation containing a canary link. The link recorded 49 HTTP requests from 43 IP addresses over 24 days; filtering indicated repeated VPN, proxy, and non-hosting-network access consistent with manual interaction, but telemetry did not support attribution.
A second persona posing as a PwC-associated professional sent a forged NDA that required WhatsApp and personal-email communications and discouraged consultation with internal controls. The fraudsters sought a €626,735.45 “Advance Retainer for Professional Services” wire transfer from Avast Software s.r.o. to a Hong Kong company and requested SWIFT MT103 and UETR details.
Operators contacted a Gen legal-team member on WhatsApp while impersonating a genuine Dublin-based Gen executive, using the executive's name, photo, and an Irish phone number. The employee identified the fraud after recognizing that the caller's voice did not match the impersonated colleague.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcegendigital.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign known as Operation MoneyMount-ISO has been identified targeting finance, accounting, treasury, and payment departments in Russia. Attackers use Russian-language emails impersonating financial institutions, such as TorFX Currency Broker, to deliver ZIP attachments containing malicious ISO files. When executed, these ISO files mount as virtual drives and deploy executables that load the Phantom information-stealing malware, which is capable of credential theft, invoice and payment fraud, and unauthorized fund transfers. The campaign also targets secondary sectors including procurement, legal, HR/payroll, executive assistants, and Russian-speaking SMEs, posing significant risks of lateral movement within IT systems. Technical analysis reveals that the infection chain involves a multi-stage payload delivery, with the initial executable loading a DLL (`CreativeAI.dll`) that decrypts and injects the final Phantom Stealer payload into memory. The campaign demonstrates advanced social engineering and technical sophistication, leveraging fake payment confirmation lures and ISO mounting to bypass traditional security controls. Security researchers emphasize the need for heightened vigilance among Russian financial organizations and recommend monitoring for related IOCs and MITRE ATT&CK techniques associated with this threat.
Jun 29, 2026
A campaign dubbed **Boss Scam** is targeting Indian enterprises by hijacking senior executives’ **WhatsApp Web** sessions and using the real accounts to send fraudulent payment requests. Attackers reportedly lure victims with urgent compliance-themed messages, including notices impersonating regulators such as the Reserve Bank of India, and deliver malicious ZIP archives that executives are tricked into forwarding to finance staff. Indian authorities said the scheme has led to rapid transfers to mule accounts, with some cases involving losses of up to **Rs. 2,45,00,000**. The ZIP files contain a legitimate signed executable paired with a malicious DLL that abuses **DLL sideloading** on Windows. Once executed, the malware can establish persistence, search Chromium-based browsers for active WhatsApp Web sessions, and steal cookies, authentication tokens, IndexedDB data, saved credentials, and encryption material; some reports say the data is archived with `tar.exe` and exfiltrated over TCP to clone the victim’s session. The attackers then impersonate executives or trusted employees to request wire transfers, spread additional malicious messages, or steal corporate information, and may fall back to saving an attacker-controlled number under the executive’s name if the hijacked session is cut off.
Jul 3, 2026
Attackers used an HR-themed adversary-in-the-middle (**AiTM**) phishing lure to steal an authenticated Microsoft 365 session from a finance employee and hijack a shared accounts-payable mailbox, enabling a cloud-only business email compromise without malware. Investigators found the victim’s real Microsoft 365 login and MFA approval were relayed through the phishing page, after which the attackers replayed the captured session cookie from commercial VPN infrastructure; Microsoft 365 telemetry showed MFA as previously satisfied, and Entra ID logs recorded impossible-travel activity between Amsterdam and Los Angeles within about a minute. With access to Exchange Online, SharePoint, Microsoft 365 Search, and finance mailboxes, the attackers monitored legitimate invoice workflows and carried out a roughly 30-day payment-diversion scheme using both vendor impersonation and internal look-alike-domain impersonation. They also created malicious inbox rules, deleted or hid collection notices and other messages that could reveal the fraud, while investigators correlated browser history, email headers, mailbox audit logs, and sign-in telemetry to confirm session-token replay and cloud account compromise.
Aug 21, 2026