Cybercriminals Deploy Elaborate ‘Phantom Deal’ Scheme to Trick Mid‑Level Staff at Major Corporations

Security researchers have identified a new wave of business‑email compromise operations that focus on large enterprises, using a campaign dubbed “Phantom Deal” to masquerade as merger and acquisition negotiations. The approach differs from generic phishing attacks by targeting mid‑level employees who are often responsible for initiating substantial wire transfers during deal discussions.

The perpetrators conduct exhaustive reconnaissance on prospective victims, gathering public filings, press releases, and organizational charts to craft highly credible communications. By mirroring the language of actual M&A correspondence and referencing specific corporate milestones, the fraudsters increase the likelihood that recipients will act without seeking higher‑level verification.

According to the original Dark Reading report, the campaign’s success hinges on convincing targeted staff that they are facilitating a legitimate transaction. Attack emails frequently contain forged signatures, realistic branding, and references to confidential deal terms that only insiders would know. Once a victim authorizes a payment, the funds are quickly routed through a series of offshore accounts, making recovery difficult.

Industry analysts note that the focus on mid‑level personnel reflects a shift in attacker tactics. Senior executives are typically more cautious and have stricter approval workflows, whereas managers handling day‑to‑day deal logistics may have the authority to move money but lack rigorous verification protocols. This gap creates an attractive attack surface for groups that can invest time in detailed target profiling.

Experts advise organizations to reinforce internal controls by requiring multi‑factor authentication for all financial requests, instituting mandatory cross‑departmental confirmation for large transfers, and providing regular training on the hallmarks of sophisticated business‑email compromise. Updating email authentication standards such as DMARC, SPF, and DKIM can also reduce the risk of spoofed messages reaching inboxes.

As the “Phantom Deal” operation continues to evolve, security teams are urged to monitor for anomalous communication patterns and to treat any unsolicited M&A‑related request with heightened scrutiny. Ongoing collaboration between corporate security units and external threat‑intelligence providers will be essential to stay ahead of actors who are willing to invest significant resources into mimicking legitimate corporate transactions.