SideWinder Hacker Group Targets Users with Fake Outlook/Zimbra Portals to Steal Login Credentials

The SideWinder APT group has intensified its credential harvesting operations across South Asia, launching sophisticated phishing campaigns that lure officials with fake Outlook Web App and Zimbra portals to steal login credentials, according to Hunt[.]io. The campaign builds on activity from August 2024, when the group operated 14 malicious pages hosted on Netlify and pages[.]dev, and researchers note it has maintained active operations for over eight months while continually adapting to evade detection.

Hunt[.]io identifies over 100 domains linked to government targets in Pakistan, Nepal, Bangladesh, Sri Lanka, and Myanmar, with Nepal highlighted as a primary focus through 17 active portals between May and September 2024. The attackers impersonate high-value entities such as SUPARCO and other national bodies, and use free hosting platforms like Netlify, Cloudflare Pages, and Back4App to host their portals, while employing JavaScript-based phishing kits that Base64-encode victims’ addresses.

The operation also shows maritime sector targeting and shared infrastructure across campaigns, with an IP linked to govmm[.]org and related domains, and a pivot to maintain persistence despite domain cycling.