Cybercriminals impersonated Gen executives and trusted business advisers in a targeted fraud campaign designed to steal more than €626,000 through a fake corporate acquisition.
The campaign, called Phantom Deal, began with a WhatsApp message from a person claiming to be a real Gen executive in Dublin. The attacker used the executive’s name, photograph and an Irish phone number to make the approach appear legitimate.
The initial message did not mention money or urgency. Instead, it asked whether the target was available to talk.
The recipient, a Gen legal-team employee identified as David, knew the executive being impersonated. He became suspicious because the phone number was unfamiliar.
A phone call confirmed the fraud. The caller’s voice did not match the real executive. David continued the conversation as part of a controlled investigation. The attackers then introduced another fake identity, impersonating a real professional connected to PwC.
They asked David to use a personal email address and communicate through WhatsApp instead of official company channels.
Fake NDAs Drain Corporate Payments
The attackers sent a professional-looking non-disclosure agreement, or NDA, branded as a PwC document. The fake document claimed Gen was involved in a confidential acquisition and imposed strict secrecy rules.
The NDA instructed David not to discuss the deal internally and to use WhatsApp and personal email for all communication. This was a key part of the fraud.
The criminals used the NDA to make unusual behavior appear legitimate. In a real corporate transaction, staff may be required to protect confidential information. However, they should never be told to bypass verification procedures, payment controls or trusted internal teams.
The acquisition story used real company history to build credibility. It referenced Avast Software, NortonLifeLock Ireland Limited and Gen Digital.
NortonLifeLock acquired Avast in 2022, making the fabricated transaction appear plausible on the surface. However, the attackers made mistakes.
David identified inconsistencies in the explanation for why Avast Software should make a payment for NortonLifeLock Ireland Limited. His knowledge of legal processes and internal company operations helped expose the scam.
The forged NDA was more than supporting paperwork. It was the main social-engineering tool used to isolate the target from Legal, Finance, Treasury and other colleagues who could challenge the request.
After establishing the fake acquisition narrative, the attackers requested a transfer of €626,735.45. They instructed Avast Software s.r.o. to send the money to a company in Hong Kong.
The payment was described as an “Advance Retainer for Professional Services.” The criminals claimed the money would be treated as an intercompany receivable and repaid after the supposed acquisition announcement, gendigital said.
Once the payment request was delivered, the attackers repeatedly asked for a SWIFT MT103 document.
An MT103 is proof that an international wire transfer has been executed. They also requested a UETR, a unique transaction reference used to track payments through the SWIFT network.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
