Phantom Deal Hackers Impersonate Executives and Use Fake NDAs to Steal Corporate Wire Transfers

Cybercriminals are using fake acquisition deals to steer employees toward large wire transfers. The campaign, called Phantom Deal, begins with a believable WhatsApp message from someone appearing to be a known executive.

It turns everyday corporate safeguards into barriers that the victim is told must be avoided to protect a confidential transaction. The operators used no malware, stolen mailbox, or malicious attachment.

Instead, they combined real names, photographs, company history and familiar deal language to make a fictional transaction seem routine. The case shows how a financial attack can develop inside ordinary business conversations.

Analysts at Gen Digital identified the campaign after an attacker contacted a member of its legal team while posing as a Dublin-based executive.