Operation DoppelBrand: Massive Fortune 500 Brand Impersonation Campaign Uncovered

Socradar • February 16, 2026

Share: View original

The campaign, attributed to a financially-motivated threat actor known as GS7, represents a significant evolution in credential theft operations— ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation DoppelBrand Targets Fortune 500 Firms for Credential Theft Operation DoppelBrand is a phishing campaign identified by SOCRadar that targets major financial and technology firms, including Wells Fargo and USAA. The campaign, attributed to the financially motivated threat actor GS7, took place between December 2025 and January 2026, with links to prior activities dating back to 2022. 6 sources 33

Extracted Entities

Attack Types (1)

Campaigns (1)

Operation DoppelBrand

MITRE ATT&CK (1)

T1003 - OS Credential Dumping