PerSwaysion Campaign

Group-IB details the PerSwaysion campaign: a targeted, multi-stage phishing operation (since mid‑2019) that uses malicious PDFs and legitimate Microsoft file-sharing previews (Sway/SharePoint/OneNote) to redirect victims to a modular phishing kit that harvests Office365 credentials. The report documents 156 high-profile compromises across North America and global financial hubs, analyzes the phishing kit (Vue.js/axios, unique JS naming, fingerprinting, serial-number gating), enumerates IOCs and threat actor emails, and describes rapid post-compromise lateral phishing and data-dump behaviors used to proliferate infections.