Researchers tracking the campaign found attackers used forged non-disclosure agreements and realistic acquisition narratives to move conversations to WhatsApp and personal email, isolating employees before attempting a payment request. The target in this case recognized inconsistencies and avoided loss.
Attackers used forged NDAs that explicitly instructed victims to handle the matter over WhatsApp and personal email to avoid corporate detection.
The campaign combined impersonation of real executives and consultants with a believable acquisition story tied to Avast and NortonLifeLock/Gen Digital.
# What happened
# How the attack was structured The operation began with impersonation of a real Gen executive based in Dublin. That persona introduced a second impersonated individual who claimed to work at PwC. After initial trust-building, the attackers asked the target for a private email address. The forged NDA that followed explicitly instructed the recipient to keep all acquisition-related communication on WhatsApp and personal email.
The narrative behind the approach drew on actual corporate history. The fabricated acquisition referenced Avast Software and NortonLifeLock Ireland Limited and connected those names to the creation of Gen Digital. That choice made the storyline familiar and potentially plausible to a company insider.
# Why the attackers wanted private channels By moving the conversation off corporate systems, the threat actors attempted to bypass internal monitoring, gatekeepers, and standard transaction controls. The campaign kept details and any payment instructions out of channels where security teams and automated systems would normally detect anomalies.
The targeted employee recognized red flags and intentionally engaged with the attackers to observe their behavior. Because the employee had legal experience and knowledge of internal transaction processes, they identified inconsistencies in the explanation for why Avast should make a payment on behalf of NortonLifeLock Ireland Limited. Those inconsistencies undermined the payment story before money was requested or transferred.
# Assessment of the attackers' capability This was a tailored operation rather than a broad spray campaign. The threat actors performed reconnaissance to reference real corporate events and relationships, making the story more credible. However, execution had gaps: the payment narrative and some transactional details were inconsistent. Had those details been tighter, the same playbook could have been considerably more convincing.
# Concrete signals to watch for
# Bottom line The campaign demonstrates a repeatable social engineering approach: use believable context and forged documents to isolate a target on channels outside corporate controls, then present a payment request. In this incident the target's background and vigilance prevented loss, but the tactic is credible enough that small inconsistencies are the difference between detection and compromise.
Threat actors impersonated Gen executives and major consulting firms in a targeted business email compromise-style operation that used forged non-disclosure agreements to isolate a legal employee and pressure the company into transferring €626,735.45 to a Hong Kong entity. Dubbed Phantom Deal, the campaign shows how fi
Cybercriminals are using fake acquisition deals to steer employees toward large wire transfers. The campaign, called Phantom Deal, begins with a believable WhatsApp message from someone appearing to be a known executive. It turns everyday corporate safeguards into barriers that the victim is told must be avoided to pro
.png%3Flanguage%3Den)
Threat actors are impersonating university leaders and using fabricated sexual misconduct allegations to pressure recipients into downloading Zoho Assist, a legitimate remote access tool abused to gain control of victims’ computers. The campaign uses convincing university branding and trusted services such as Google Dr
N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse legitimate authentication flows. Successful attacks can give threat actors access to valid accounts without relying on obvious malware activity. From there, a single compromised identity c
Threat actors’ abuse of enterprise collaboration tools increased fourfold over the past twelve months, according to researchers at Palo Alto Networks’ Unit 42.
Lead Analysts : Prabhakaran Ravichandhiran, Jeewan Singh Jalal
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.