Social engineers target enterprises with fake M&A scams

Social engineers are attempting to trick companies into making large wire transfers to their own accounts by posing as participants in fake merger and acquisition deals. This sophisticated advance fee scam, adapted for a new generation, has put companies at risk of losing significant sums of money, as first reported by Dark Reading.

The "Phantom Deal" campaign involves threat actors meticulously researching targets, identifying key personnel like those in legal departments. Attackers impersonate company executives via messaging apps like WhatsApp, initiating contact with plausible, albeit vague, acquisition scenarios. They leverage real corporate history, such as the NortonLifeLock acquisition of Avast, to build a believable narrative. A second threat actor may impersonate a representative from a reputable firm like PricewaterhouseCoopers, providing a fabricated non-disclosure agreement to ensure secrecy and limit communication channels. The ultimate goal is to request a specific, often large, monetary transfer to a foreign account to facilitate the supposed deal. While this particular scam was foiled by an employee's attention to detail and a voice mismatch during a phone call, the attackers' methodology highlights the increasing sophistication of social engineering tactics. The campaign has targeted senior employees across various industries, including private equity, finance, and energy, with customized approaches. Companies are advised to reinforce verification and payment controls, as even thorough reconnaissance by attackers should not be enough to bypass these safeguards. Employees are encouraged to verify requests and report any suspicious activity rather than engaging further with potential scammers.

Source: Dark Reading