Security Firm Executive Targeted in Sophisticated Phishing Attack

A C-level executive at Swedish exposure management and identity security firm Outpost24 was targeted in a sophisticated phishing attack, the company’s subsidiary Specops Software reports. The attack, likely mounted with a recently identified phishing-as-a-service kit named Kratos, relied on a seven-step chain that leveraged layered infrastructure and legitimate services to evade detection and deceive the recipient. The phishing message, impersonating financial services provider JP Morgan, appeared as if part of an existing email thread to increase its sense of legitimacy, and invited the recipient to review and sign a document. Furthermore, the attackers used two DomainKeys Identified Mail (DKIM) signatures to ensure the email would pass DMARC authentication and appear trustworthy. Within the message, the attackers included a ‘review document’ link pointing to the legitimate Cisco domain secure-web.cisco.com, which is typically used for rewriting URLs in emails after they have been validated by Cisco. Because the link passed Cisco’s Secure Email Gateway validation, the redirect URL was hosted on Cisco’s infrastructure, further allowing the phishing email to bypass detection systems. The next step in the chain involved a redirection to the legitimate email API platform Nylas, which was likely used to ensure that the phishing link would redirect through Cisco Secure Web infrastructure. “By chaining redirects through legitimate services such as Cisco and Nylas, the attackers increase the likelihood that the link will pass security filtering and reputation checks. These domains are widely trusted and commonly observed in legitimate traffic, which makes automated blocking more difficult,” Specops notes. Next, the target was redirected to a subdomain on the website of a legitimate development company based in India, and then to a domain that was originally registered in 2017 by a Chinese entity. The domain’s previous TLS certificate expired on March 6, the associated DNS records were released shortly after, and the domain was re-registered on March 12, with several new TLS certificates issued for it the same day. “The timing strongly suggests the domain was reacquired and repurposed specifically for this campaign,” Specops notes. The user was redirected once again, this time to phishing infrastructure that was deployed behind Cloudflare to hide its origin server. At this stage, the victim was served a browser validation check, likely meant to prevent security analysis. Finally, the victim would be served a convincing phishing page meant to harvest Microsoft 365 credentials. “Like the rest of the attack chain, this step is also carefully constructed, from a fake loading animation imitating Outlook to a check that validates whether the user input is actually an email. As the final step, the site attempts a legitimate login to verify that the captured credentials are valid,” Specops explains. The cybersecurity firm confirmed to SecurityWeek that the individual targeted in this attack was a C-level executive at its parent company Outpost24, underlining the sophistication of the attack. Specops did not attribute the incident to a specific threat actor but noted that the modus operandi aligns perfectly with that of Iran-linked threat actors that recently targeted various entities in the US. On the other hand, the firm said, other hacking groups have been observed employing similar tactics, and attribution remains elusive. Related: Internet Infrastructure TLD .arpa Abused in Phishing Attacks Related: Tycoon 2FA Phishing Platform Dismantled in Global Takedown Related: LastPass Warns of New Phishing Campaign Related: ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing WRITTEN BY Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire Bold Security Emerges From Stealth With $40 Million in Funding Google Paid Out $17 Million in Bug Bounty Rewards in 2025 Onyx Security Launches With $40 Million in Funding Chrome 146 Update Patches Two Exploited Zero-Days Ally WordPress Plugin Flaw Exposes Over 200,000 Websites to Attacks Splunk, Zoom Patch Severe Vulnerabilities Cisco Patches High-Severity IOS XR Vulnerabilities Critical N8n Vulnerabilities Allowed Server Takeover Latest News Oracle EBS Hack: Only 4 Corporate Giants Still Silent on Potential Impact China-Linked Hackers Hit Asian Militaries in Patient Espionage Operation Threat Actor Targeting VPN Users in New Credential Theft Campaign ForceMemo: Python Repositories Compromised in GlassWorm Aftermath Hacking Attempt Reported at Poland’s Nuclear Research Center Loblaw Data Breach Impacts Customer Information Critical HPE AOS-CX Vulnerability Allows Admin Password Resets Starbucks Data Breach Impacts Employees Trending Webinar: Securing Fragile OT In An Exposed World March 10, 2026 Get a candid look at the current OT threat landscape as we move past "doom and gloom" to discuss the mechanics of modern OT exposure. Register Virtual Event: Supply Chain Security And Third-Party Risk Summit March 18, 2026 Join the event where top security experts unpack the biggest software supply chain risks. Register People on the Move The US Senate has confirmed Army Lt. Gen. Joshua Rudd to lead NSA and CYBERCOM. Business software company Rippling has appointed Adrian Ludwig as CSO. Orca Security has named Rachel Nislick as Chief Marketing Officer. More People On The Move Expert Insights The Human IOC: Why Security Professionals Struggle With Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) How To 10x Your Vulnerability Management Program In The Agentic Era The evolution of vulnerability management in the agentic era is characterized by continuous telemetry, contextual prioritization and the ultimate goal of agentic remediation. (Nadir Izrael) SIM Swaps Expose A Critical Flaw In Identity Security SIM swap attacks exploit misplaced trust in phone numbers and human processes to bypass authentication controls and seize high-value accounts. (Torsten George) Four Risks Boards Cannot Treat As Background Noise The goal isn’t about preventing every attack but about keeping the business running when attacks succeed. (Steve Durbin) How To Eliminate The Technical Debt Of Insecure AI-Assisted Software Development Developers must view AI as a collaborator to be closely monitored, rather than an autonomous entity to be unleashed. Without such a mindset, crippling tech debt is inevitable. (Matias Madou) Flipboard Reddit Whatsapp Email