Operation DoppelBrand: Weaponizing Fortune 500 Brands

Operation DoppelBrand is an ongoing, sophisticated phishing campaign run by a group called GS7 that targets Fortune 500 and other high-value organizations—primarily in English-speaking markets—by creating highly convincing, brand-impersonating login portals. The actors register large numbers of malicious domains, route traffic through Cloudflare to mask infrastructure, exfiltrate harvested credentials and telemetry to Telegram bots, and deploy RMM tools to enable remote access or resale of access to affiliates, indicating a high-risk, financially motivated criminal operation.