A Phishing Campaign That Kept Hitting for Years

A phishing wave does not need malware, a zero-day flaw, or a loud intrusion to be dangerous. When it runs for years and reaches hundreds of organizations, the real story is not only volume but persistence: a steady abuse of routine communication, identity, and urgency. At the center of this case is a broad campaign that appears designed to exploit normal business workflows rather than technical weaknesses in any single system.

Fast Facts

• More than 500 organizations were affected in a phishing campaign described as years-long.
• Victim organizations span aviation, critical infrastructure, energy, logistics, public administration, and technology.
• Phishing is a recognized initial-access technique that can use email, text messages, collaboration tools, or phone follow-ups.
• The public record does not establish whether credentials were stolen, data was exfiltrated, or systems were fully compromised.
• The scale may indicate repeatable lures and infrastructure, although that is not confirmed.

Why the scale matters

Phishing is often treated as a user-awareness problem, but MITRE ATT&CK classifies it as a serious entry technique because it can be the first step toward account takeover, internal access, or further social engineering. The important detail here is breadth: a campaign that touches so many organizations is usually built to blend into ordinary traffic, not to trigger obvious alarms.

That matters in sectors where identity is tied to operations. Aviation, energy, logistics, and public administration all depend on email, scheduling, vendor coordination, and authenticated workflows. In those environments, a convincing message may be enough to create risk even if no exploit is involved. From a defensive perspective, the concern is not just the inbox itself, but the downstream systems that trust the inbox.

The long duration of the campaign also suggests a sustained operational effort. That does not prove a single attacker, a shared infrastructure, or a specific lure method. It does, however, show how phishing can stay effective when attackers continually refresh messages, rotate sending systems, and adapt to filters and user training. The broader lesson is uncomfortable: social engineering scales because organizations still rely on people making rapid trust decisions under pressure.

At the time of writing, public information has not fully established the technical root cause, the complete scope of affected users, or whether downstream systems were compromised. The available information supports a risk analysis, not a definitive claim of stolen data or full breach.

For defenders, the practical response is familiar but still hard: phishing-resistant MFA, stronger email authentication, user reporting paths, and monitoring for suspicious logins and unusual account behavior. In a campaign like this, one successful lure may be enough to create a foothold, but the larger failure often begins when that foothold goes unnoticed.

Conclusion

The enduring lesson is that phishing is not a nuisance category. It is an access strategy, a trust attack, and a test of whether organizations can recognize abuse before it becomes operational harm. In a connected environment, resilience starts with assuming that every message can be a security event.

TECHCROOK

Hardware security key: A small USB or NFC device used for phishing-resistant multi-factor authentication. It adds a second factor that is harder to intercept than codes sent by text or email. Useful for personal accounts and for organizations that want a simple, physical login factor for high-value users.

Scheda Techcrook: Hardware security key

WIKICROOK

• Phishing: A social engineering method that tricks people into revealing credentials or taking risky actions.
• MITRE ATT&CK T1566: The ATT&CK technique covering phishing and related delivery methods.
• Phishing-resistant MFA: Multi-factor authentication designed to resist interception and credential replay.
• Email authentication: SPF, DKIM, and DMARC controls that help verify whether a message is legitimate.
• Initial access: The first foothold an attacker gains in a target environment.