Threat Actors Leverage Real Enterprise Email Threads to Deliver Phishing Links

This report details a sophisticated supply-chain phishing campaign (active since Dec 2025) where attackers hijacked legitimate enterprise email threads via a compromised contractor account to deliver EvilProxy-based phishing pages that bypass bot protections (Cloudflare Turnstile) and exfiltrate credentials and session tokens; the campaign primarily targets Middle Eastern finance and energy firms and includes multiple IOCs and recommended mitigations.