Massive Phishing Campaign Targets 9 Million Boots Shoppers

• •Nearly 9 million UK shoppers targeted in a phishing scam impersonating Boots.
• •Attackers utilized a compromised Bolivian government website to host fake pages.
• •The campaign is linked to Romanian threat actors and may be part of a larger operation.

A large-scale phishing campaign impersonating Boots has targeted nearly 9 million UK shoppers. The scam offered free beauty sample packs in exchange for personal information through a fake survey. Attackers used a compromised Bolivian government website to host the fraudulent checkout page, enhancing its credibility. Emails were sent from a compromised UK business server using Gammadyne Mailer, a legitimate bulk email tool. The phishing emails featured personalized subject lines and appeared to come from '[email protected]'. Huntress, the cybersecurity firm that detected the campaign, noted that Boots' systems were not compromised. The attack is believed to be part of a broader operation involving tax-related and cryptocurrency scams. The campaign was detected on May 15, 2026, and efforts were made to block outbound connections shortly after.