Executive Summary
The Phantom Deal campaign is a highly targeted business process compromise (BPC) operation that leverages the secrecy of Mergers and Acquisitions (M&A) to facilitate wire fraud. Attackers impersonate high-level executives and reputable advisory firms like PwC or KPMG, initiating contact through WhatsApp to establish rapport before moving to personal email channels to bypass corporate security controls.
The attack chain relies on forged Non-Disclosure Agreements (NDAs) that serve as a psychological payload, instructing victims to maintain absolute secrecy and bypass standard verification processes. The campaign culminates in requests for large international wire transfers—observed in one case to be over €600,000—directed toward Hong Kong-based entities, followed by aggressive demands for SWIFT MT103 and UETR confirmation data to monitor the funds' movement.
This threat is particularly dangerous because it does not utilize traditional malware or technical exploits. Instead, it exploits organizational confidentiality culture and familiarity with corporate history to induce process failures in legal and finance departments across sectors like mining, energy, and private equity.