Cofense Intelligence reports a significant evolution in finance-themed phishing from Q1 2025 to Q1 2026, with threat actors shifting from urgency-driven subject lines to operational business language that mirrors routine financial workflows. By Q1 2026, 79% of finance-themed phishing campaigns used operational language rather than pressure tactics, making them harder to distinguish from legitimate correspondence and more likely to bypass SEGs. The campaigns leverage three main lure categories — New Business, Contracts in Progress, and Payments — and deliver credential phishing via embedded URLs and QR codes in PDF attachments.
SEG Bypass
2 posts
When Routine Becomes the Threat: The Evolution of Finance-Themed Phishing World Cup-Themed Phishing Campaign Delivers Voidrift Malware with Highly Personalized Lures A sophisticated phishing campaign is leveraging highly personalized FIFA World Cup 2026 lures to deliver the evasive Voidrift malware. The attackers utilize extensive reconnaissance to embed target company logos into the email lures and host payloads on legitimate domains, successfully bypassing multiple prominent Secure Email Gateways.