A new social engineering campaign, dubbed Phantom Deal, has been targeting large enterprises with highly crafted fake merger and acquisition requests. The attackers studied their targets in great detail, including public corporate histories and internal workflows, to persuade midlevel employees to authorise substantial payments.
In one documented incident, a Gen security communicator (“David” from the legal team) was approached via a WhatsApp message impersonating an executive, followed by a PwC-branded NDA and a demand to keep communications off corporate networks. The ruse culminated in a demand to transfer €626,735.45 to a company in Hong Kong to facilitate a supposed confidential deal.
The operation proceeded with plausible details such as real corporate history (notably NortonLifeLock’s 2022 Avast merger) and tailored sequencing around legitimate acquisition narratives, aided by a free‑form email that falsely confirmed a transaction.
Gen’s investigation, supported by the campaign’s metadata, identified four additional targets across sectors including private equity, industrial finance, sales, mining and energy. In the Gen case, the attacker’s voice raised early warning signs, and an attentive employee halted the transfer after verifying the identity and the nature of the request.
Analysts emphasise that the attackers’ method was sophisticated but relied on a flawed overall narrative, meaning a coherent story could enable far more damaging outcomes. The takeaway stresses that security teams should focus on validating the process and the transaction, not merely the individual posing as an executive, and to report suspicious activity promptly to prevent legitimate transfers being siphoned away.
The report also notes that attackers leveraged publicly available information, but defensive success hinged on diligent verification and clear payment controls.