This threat involves a sophisticated phishing campaign targeting manufacturing companies through multi-stage email interactions. Attackers first engage victims with personalized emails referencing actual products, then send phishing links to fake cloud document services designed to steal corporate email credentials. The phishing sites mimic legitimate PDF cloud services and prompt victims to enter their work email and password under the pretense of accessing confidential files. The attackers use AI-generated email content and free email services without known bad reputations to evade detection. The campaign is ongoing and has targeted companies in Russia, the Czech Republic, Malaysia, and Egypt, among others.

Successful exploitation results in theft of corporate email credentials, potentially allowing attackers unauthorized access to corporate email accounts. This can lead to further compromise of corporate networks, data breaches, or fraud. The attack specifically targets manufacturing companies, leveraging detailed reconnaissance to increase success likelihood.

No official patch is applicable as this is a phishing attack. Kaspersky recommends raising employee security awareness to recognize sophisticated phishing attempts. Deployment of email gateway security solutions, such as Kaspersky Secure Mail Gateway, can detect and block these phishing emails before they reach users. Vigilance is advised as the attack is ongoing.