Operation DoppelBrand: Sophisticated Phishing Campaign Targets Fortune 500 Firms An elusive cyberthreat group known as GS7 has been running Operation DoppelBrand, a large-scale phishing campaign targeting Fortune 500 companies, financial institutions, and high-value entities worldwide. First observed between December 2025 and January 2026, the operation leverages near-perfect replicas of corporate login portals to steal credentials and deploy remote management and monitoring (RMM) tools for further exploitation. ### Key Details of the Campaign - Targets: Primarily U.S.-based financial institutions including Wells Fargo, USAA, Navy Federal Credit Union, Fidelity Investments, and Citibank alongside technology, healthcare, and telecommunications firms in Europe and other regions. - Tactics: GS7 registers over 150 malicious domains via registrars like NameCheap and OwnRegistrar, routing traffic through Cloudflare to evade detection. Attackers exfiltrate stolen data usernames, passwords, IP addresses, geolocation, device fingerprints, and timestamps to Telegram bots controlled by the group. - Infrastructure: The group has operated since at least 2022, with claims of activity dating back nearly a decade. Researchers linked GS7 to Brazilian cybercrime forums, where stolen credentials and financial data are traded. - Impact: Beyond credential theft, GS7 installs RMM tools on victim systems, enabling remote access or malware deployment. The campaign’s sophistication including rotating infrastructure and meticulous branding mimicry has allowed it to evade detection until now. ### Researcher Findings Security firm SOCRadar uncovered the operation, identifying a Telegram group ("NfResultz by GS") tied to the threat actor. A self-proclaimed GS7 member provided screenshots of past campaigns, including a Fidelity Investments phishing demo that triggered RMM tool downloads upon login. SOCRadar released TTPs (tactics, techniques, and procedures) and IoCs (indicators of compromise) to help defenders track the group’s activities. With English-speaking markets as the primary focus, GS7’s DoppelBrand campaign remains active, underscoring the growing threat of highly organized, financially motivated phishing operations.

Cybersecurity researcher Jeremiah Fowler discovered an unprotected 378 GB database belonging to Navy Federal Credit Union (NFCU), exposed publicly without encryption or password protection. The breach revealed sensitive internal files, including operational metadata, hashed passwords, system logs, plain-text usernames/emails, and Tableau workbooks containing database connection details, financial formulas, and loan portfolio metrics. While no direct customer data (e.g., account numbers, SSNs) was exposed in plain text, the leaked internal details—such as employee credentials, system architectures, and business intelligence—create severe risks. Attackers could exploit this information for phishing, credential stuffing, or supply-chain attacks, potentially escalating access to member data or financial systems. The incident underscores systemic vulnerabilities in third-party handling of sensitive data, though NFCU secured the database after discovery. The exposure, while not immediately catastrophic, provides cybercriminals with a roadmap for deeper intrusions, threatening long-term operational and member security.