Spear-Phishing Campaign Targets Financial Executives
KnowBe4, Monday, June 9th, 2025
Researchers at Trellix warn of a spear-phishing campaign that's targeting CFOs around the world with phony employment offers. The emails are designed to deliver a legitimate remote access tool that will give the attacker a foothold on the victim's machine.
'On May 15th, Trellix's email security products alerted on a highly targeted spear-phishing operation aimed at CFOs and finance executives at banks, energy companies, insurers, and investment firms across Europe, Africa, Canada, the Middle East, and South Asia,' the researchers write.
'In what appears to be a multi-stage phishing operation, the attackers aimed to deploy NetBird, a legitimate WireGuard-based remote-access tool on the victim's computer. In recent years, adversaries have increasingly relied on remote-access applications like this to establish persistence and further their way into the victim's network.'