Spear Phishing Scams: The CEO Impersonation Fraud Threatening IT Companies

CloudSEK analyzed a spear-phishing campaign targeting IT-sector executives in India in which threat actors impersonate CEOs on WhatsApp/SMS—using publicly available profile images and contact data harvested from LinkedIn and commercial intelligence services (e.g., SignalHire, ZoomInfo) or purchased on cybercrime forums—to pressure employees into urgent actions such as purchasing gift cards, wiring funds, or sharing credentials; the report includes TTPs, forum evidence of sold contact databases, illustrative messages, and mitigation recommendations.