Operation HookedWing Phishing Campaign Stole Credentials at Over 500 Organizations
Summary
SOCRadar reports that the four-year Operation HookedWing campaign stole more than 2,000 credentials across over 500 organizations, using evolving infrastructure and personalized phishing pages that impersonated Microsoft Outlook.
Key points
- SOCRadar says the campaign has operated for more than four years and affected over 500 organizations across multiple sectors.
- More than 2,000 user credentials were reportedly stolen.
- The campaign used HR- or colleague-themed emails and notifications to direct victims to phishing pages, often through GitHub links or intermediaries.
- Pages mimicked Microsoft Outlook, personalized text for victim organizations, and used a pre-loader before presenting a sign-in form.
- A background script validated email addresses and URLs, collected credentials and victim geolocation, and sent the information to the attacker.
- SOCRadar identified two dozen associated command-and-control servers, over 100 GitHub domains, and more than a dozen distribution domains on other platforms.
Article Details
- Event Type
- Multi-year phishing campaign, dubbed Operation HookedWing, using impersonation emails and fake sign-in pages to steal credentials.
- Impact
- SOCRadar reports that more than 2,000 user credentials were stolen across over 500 organizations in multiple sectors. Collected data included email addresses, passwords, IP addresses, geolocation, source URLs, and victim organization domains.
MITRE ATT&CK
Vendors
Products
GitHubBetween 2022 and 2024, Operation HookedWing used GitHub domains with English content and compromised servers as infrastructure, and the attacks mainly featured Microsoft and Outlook themes.OutlookBetween 2022 and 2024, Operation HookedWing used GitHub domains with English content and compromised servers as infrastructure, and the attacks mainly featured Microsoft and Outlook themes.
Industries
aviation and travelthe course of four years, more than 2,000 user credentials across over 500 organizations in the aviation and travel, critical infrastructure, energy, financial, government, logistics, public administration, andCritical infrastructuremore than 2,000 user credentials across over 500 organizations in the aviation and travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors wereEnergy2,000 user credentials across over 500 organizations in the aviation and travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors were stolen as part offinancialcredentials across over 500 organizations in the aviation and travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors were stolen as part of theGovernmentacross over 500 organizations in the aviation and travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors were stolen as part of the campaign.logistics500 organizations in the aviation and travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors were stolen as part of the campaign.Public administrationin the aviation and travel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors were stolen as part of the campaign.Technologytravel, critical infrastructure, energy, financial, government, logistics, public administration, and technology sectors were stolen as part of the campaign.