CYBERSECURITY researchers at Gen Digital have uncovered an executive impersonation scam dubbed the Phantom Deal campaign. The operation targeted corporate legal, finance, and M&A executives by posing as company leaders and trusted advisers to manufacture a confidential, fake acquisition.
In Gen’s analysis, an initial WhatsApp outreach from someone claiming to be a Dublin-based executive set the scene, followed by a second actor portraying an external PwC legal adviser who requested a private email for confidential documents. A forged non-disclosure agreement was produced, instructing the recipient to keep all deal discussions on WhatsApp and private email, effectively bypassing usual governance channels and enabling the fraud to unfold.
The scammers then directed the victim to transfer 626,735.45 euros to a Hong Kong bank account, presenting it as an advance retainer for advisory services in a fictitious acquisition. They pressed for confirmation via a SWIFT MT103 and a unique transaction reference number, to monitor funds as they moved.
Security researchers countered the scheme with decoy documents and a tracking canary embedded in a fake payment confirmation email; the canary logged 49 requests from 43 IP addresses over 24 days, revealing use of VPNs and proxies. Although Gen Digital identified at least four other targets in sectors including private equity, industrial finance, energy, and mining, rapid detection prevented losses in the observed Gen case. The campaign emphasises non-technical social engineering and impersonation, rather than software exploits.
Analysts note moderate confidence that an organised cybercrime group is behind Phantom Deal, relying on business email compromise and brand abuse (including PwC, KPMG, and Ogier) rather than breaches of these firms. The investigation remains active with no arrests announced. Organizations are urged to enforce strict verification for outgoing wire transfers, use out-of-band channel confirmation, prohibit activity over private messaging apps, and require multi-person approval for major transfers.