Phantom Deal Hackers Impersonate Executives and Use Fake NDAs to Steal Corporate Wire Transfers

Gen Digital analysts identified a targeted social‑engineering campaign called "Phantom Deal" that uses WhatsApp impersonation and fake, PwC‑branded NDAs to steer employees into making large cross‑border wire transfers while avoiding official corporate channels; the attack involved no malware or mailbox compromise but exploited business processes and could result in significant financial loss if payment instructions are trusted without independent verification.