A financially motivated threat actor known as GS7 is running a large-scale phishing campaign targeting Fortune 500 companies — using pixel-perfect impersonation of legitimate login portals to steal credentials.
The campaign, active since December, impacts major financial institutions, tech firms, healthcare providers, and telecom companies across the U.S. and Europe.
What’s happening?
🔐 Brand-accurate phishing portals
GS7 registers hundreds of lookalike domains and replicates official login pages with near-perfect precision.
🌍 Mass domain infrastructure
150+ malicious domains recently registered, traffic routed via Cloudflare to hide backend servers.
📲 Real-time credential exfiltration
Stolen usernames, passwords, IP data, device fingerprints, and geolocation details are sent instantly to Telegram bots.
🖥️ Post-compromise access
Victims may unknowingly download RMM tools, enabling persistent access or resale to ransomware groups.
Why this is concerning
This isn’t spray-and-pray phishing.
It’s highly structured, infrastructure-heavy, and likely aligned with Initial Access Broker (IAB) activity.
GS7 may not be the final attacker — just the one selling the door.
Defensive takeaways
• Enforce phishing-resistant MFA
• Monitor for lookalike domains
• Restrict unauthorized RMM deployments
• Validate financial login URLs directly (avoid email links)
• Leverage IoC feeds where available
Phishing isn’t getting louder.
It’s getting more precise.
