Kaspersky experts have uncovered a phishing campaign targeting manufacturing facilities in multiple countries across Europe, Asia and the Middle East. The attackers are sending English-language emails, allegedly from potential customers interested in respective products, attempting to extort corporate data. The campaign began in April 2026 and is still ongoing.
The phishing scheme includes several stages. First, potential victims receive an email from an alleged interested buyer requesting clarification on the product, such as the exact price or availability.
If the recipient responds, they are then sent a link to download a file with the product's technical specifications, either immediately or in a subsequent email or after further discussion and questions. Clicking the link takes the user to the next phishing page that mimics a popular cloud service for working with PDF documents.
The user is then directed to an "authorisation form" asking for a corporate email address and password – allegedly for security purposes to prevent unauthorised access to the file. In reality, this is a ploy by attackers to trick users into revealing corporate data.
"We see spear phishing campaigns evolving. Attackers are increasingly moving from simple schemes to complex campaigns consisting of multiple stages, as this increases the chances of a successful attack. They also thoroughly prepare, researching organisations to craft the most convincing cover stories. For example, they develop attack scenarios tailored to the specific operating conditions of manufacturing companies. Attackers often employ AI tools to craft phishing emails or automate other processes. To reduce risks, organisations need to pay increased attention to security – implementing reliable technical tools and improving employees' cyber literacy," comments Roman Dedenok, Anti-Spam Expert at Kaspersky.
To defend organisations against this threat, Kaspersky recommends:
- Deploying a proven mail server security solution such as Kaspersky Security for Mail Server that provides secure corporate email exchange, countering spam, email-borne infections, all forms of phishing, business email compromise (BEC), QR code attacks, and other threats.
- Providing cybersecurity teams with up-to-date information on the latest tactics, techniques and procedures of attackers by using Kaspersky Threat Intelligence services.
- Improving employees’ cyber literacy through specialised courses or training, such as those on the Kaspersky Automated Security Awareness Platform.
