Massive Phishing Campaign Targets 9 Million Boots Shoppers

A large-scale phishing campaign impersonating Boots has targeted nearly 9 million UK shoppers. The scam offered free beauty sample packs in exchange for personal information through a fake survey. Attackers used a compromised Bolivian government website to host the fraudulent checkout page, enhancing its credibility. Emails were sent from a compromised UK business server using Gammadyne Mailer, a legitimate bulk email tool. The phishing emails featured personalized subject lines and appeared to come from '[email protected]'. Huntress, the cybersecurity firm that detected the campaign, noted that Boots' systems were not compromised. The attack is believed to be part of a broader operation involving tax-related and cryptocurrency scams. The campaign was detected on May 15, 2026, and efforts were made to block outbound connections shortly after.

Key Points: • Nearly 9 million UK shoppers targeted in a phishing scam impersonating Boots. • Attackers utilized a compromised Bolivian government website to host fake pages. • The campaign is linked to Romanian threat actors and may be part of a larger operation.