Vimeo-Themed Phishing Campaign Steals Personal and Banking Data
Summary
CIS analyzed a phishing campaign targeting U.S. SLTT entities with Vimeo-themed lures to harvest personal and banking data, alongside related tax-themed infrastructure delivering Datto RMM. CIS shared indicators and blocked associated domains.
Key points
- Phishing emails impersonated Vimeo support and used a legitimate Vimeo Mailgun sending path, likely through abuse of a platform feature.
- A related phishing page sought credit card details, Social Security numbers, dates of birth, PayPal credentials, and other personal data.
- Related tax-themed domains used similar webpage structures and delivered signed Datto RMM installers for potential follow-on access.
- CIS identified 94 URLs associated with Datto RMM downloads, as well as numerous tax-themed domains.
- CIS shared the domains through MS-ISAC indicator feeds and blocked them in its Malicious Domain Blocking and Reporting service.
- CIS said it could not directly observe the impact of Datto RMM use in this campaign.
Article Details
- Attack Vectors
- Phishing emails impersonated Vimeo support and linked to pages that attempted to collect victims’ payment-card details, Social Security numbers, dates of birth, PayPal credentials, and other personal data.
- Tax-themed phishing lures used URLs that downloaded Datto RMM files for possible follow-on activity; CIS CTI did not directly observe the RMM impact in this campaign.
- Defensive Notes
- CIS CTI shared campaign domains through the MS-ISAC Real-Time Indicator Feeds and blocked them in the Malicious Domain Blocking and Reporting (MDBR) service.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | verify389[.]live | Campaign-related registered domain used as an infrastructure pivot. |
| SHA256 | 9021c1b954334d1743eaf2b7ca3bab35227c7ac701d2c90de38713864c5792fa | Hash of a Datto RMM file downloaded from campaign-associated malicious domains. |
| SHA256 | efdb468a04e77d6cd0c55e6667ba0b370e5c0de6c6ad4f6c7507af2474d04182 | Hash of a Datto RMM file downloaded from campaign-associated malicious domains. |
| URL | hxxp[:]//www[.]verify389[.]live/ | Campaign-related URL hosting HTML used as a similarity-hash pivot. |
| URL | hxxps[:]//mytax-organizer[.]amosdadabooks[.]com/ | Tax-themed phishing URL associated with the campaign infrastructure. |
| URL | hxxps[:]//mytax-organizer[.]arpublication[.]com/ | Tax-themed phishing URL associated with the campaign infrastructure. |
| URL | hxxps[:]//mytax-organizer[.]noisetteroseproductions[.]com/de.php | Tax-themed phishing URL associated with the campaign infrastructure. |
| URL | hxxps[:]//s3[.]us-east-2[.]amazonaws[.]com/vdjdj.thursfri/_EFIN_TRANSCRIPT_VIEWER_02_18_2026.exe?2fjGoQJf3h2fjGoQJf3h2fjGoQJf3h | Specific AWS-hosted executable download URL identified among URLs associated with the campaign and Datto RMM downloads. |
| URL | hxxps[:]//tax-filecenter-irs[.]matthewtarwater[.]com/de.php | Tax-themed phishing URL associated with the campaign infrastructure. |
| URL | hxxps[:]//tax-filecenter[.]verrassendmykonos[.]nl/de.php | Tax-themed phishing URL associated with the campaign infrastructure. |
| URL | hxxps[:]//vimeo[.]verify389[.]live/253553798 | Phishing URL whose page attempted to harvest personal and financial data. |
| URL | hxxps[:]//vimeo[.]verify389[.]live/255126394 | Phishing URL in a sample impersonating Vimeo support. |