Suspected Scattered Spider domains target everyone from manufacturers to Chipotle

Check Point researchers disclosed roughly 500 domains that imitate corporate login portals and follow Scattered Spider naming patterns, indicating prepared or active phishing infrastructure used to harvest credentials; targets span aviation, retail, manufacturing, medical technology and enterprise platforms, with examples including chipotle-sso.com and gemini-servicedesk.com. The report links this activity to a broader wave of social-engineering-driven intrusions and recent airline data incidents (e.g., Qantas), underscoring an opportunistic criminal group using fake helpdesk calls and credential phishing at scale.