Major Phishing Campaign Exploiting Missing "X-Frame-Options" Headers Puts Global Companies at Risk

Threat actors are running a global phishing campaign that exploits missing X-Frame-Options headers to load victim domains in iframes and overlay fake login panels; harvested credentials are sent to a Telegram bot (hardcoded token/ChatID). The campaign has used VK Cloud and Firebase hosting, mass-mailing tools (SendGrid, PowerMTA, Gammadyne), targeted multiple corporate domains (1,262 victims identified), and has attribution signals pointing to a Telegram account tied to a Nigerian phone number.