Back Darkreading

Operation DoppelBrand: Weaponizing Fortune 500 Brands

Darkreading •Elizabeth Montalbano, Contributing Writer • February 16, 2026

The GS7 cyberthreat group targets US financial institutions with near-perfect imitations of corporate portals to steal credentials and gain remote access.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation DoppelBrand Targets Fortune 500 Firms for Credential Theft Operation DoppelBrand is a phishing campaign identified by SOCRadar that targets major financial and technology firms, including Wells Fargo and USAA. The campaign, attributed to the financially motivated threat actor GS7, took place between December 2025 and January 2026, with links to prior activities dating back to 2022. 6 sources 33

Extracted Entities

Operation DoppelBrand: Weaponizing Fortune 500 Brands

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Industries (1)

MITRE ATT&CK (1)