Phantom Deal Hackers Impersonate Executives and Use Fake NDAs to Steal Corporate Wire Transfers

Cybersecuritynews •Tushar Subhra Dutta • September 3, 2026

Cybercriminals are using fake acquisition deals to steer employees toward large wire transfers. The campaign, called Phantom Deal, begins with a believable WhatsApp message from someone appearing to be a known executive. It turns everyday corporate safeguards into barriers that the victim is told must be avoided to protect a confidential transaction. The operators used […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phantom Deal Scam Targets Corporations with Fake NDAs Cybercriminals executed a scam called Phantom Deal, impersonating executives and consulting firms to pressure a legal employee into transferring €626,735.45 to a Hong Kong entity. The attack utilized forged non-disclosure agreements and began with a convincing WhatsApp message from someone posing as a known executive. This tactic exploited corporate communication channels and safeguards, leading to a significant financial loss for the victimized company. The operation highlights vulnerabilities in corporate acquisition processes and the potential for financial exploitation by threat actors. As of now, the incident is under investigation, and organizations are advised to enhance their verification protocols for financial transactions. 2 sources 65

Phantom Deal Hackers Impersonate Executives and Use Fake NDAs to Steal Corporate Wire Transfers

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)