Effective Phishing Campaign Targeting European Companies and Organizations
Summary: Unit 42 researchers investigated a phishing campaign that peaked in June 2024 and remained active as of September 2024, targeting roughly 20,000 users at European automotive, chemical and industrial compound manufacturing companies in Germany, the UK and France. The emails carried Docusign-lookalike PDFs or embedded HTML links to fake forms built with HubSpot's Free Form Builder, which redirected victims to credential-harvesting pages prompting for Microsoft Azure logins.
What's compelling: Attackers added a device to victim accounts for persistent access and reset passwords when IT tried to regain control, producing a tug-of-war inside the Azure tenant; roughly 20,000 users were targeted, and the same hosting infrastructure served both the phishing pages and the connections into compromised environments.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026