Fake Acquisition Scam Uses Forged NDAs to Demand €626,000 Corporate Payment.

**Phantom Deal:** A targeted social-engineering campaign used high-fidelity impersonation of executives and advisors plus forged NDAs to isolate a legal employee and pressure an intercompany-style payment of €626,735.45 to a Hong Kong account. Attackers pushed communications to WhatsApp and personal email, demanded MT103 and UETR payment confirmations, and framed secrecy as contractual obligation to prevent independent verification; Gen researchers engaged in a controlled response, collected telemetry, and identified multiple related targets and common document artifacts. Organizations should treat any request to shift communications off corporate channels or to provide payment tracking data as a high-risk sign requiring independent verification through trusted contacts and banking controls.