Key Points
- Phishing campaigns exploiting Pride Month themes to trigger emotional responses and bypass security awareness
- Campaign occurred in two distinct waves: December 2025 with 504 targets followed by January 2026 escalation to 4,768 targets, totalling 5,272 organizations across US, UK, Germany, Australia, South Africa, Canada, and other regions
- Attack techniques align with methods used by Scattered Spider, CryptoChameleon, and PoisonSeed threat actors
- December campaign targeted financial services and consulting; January campaign shifted focus to IT, SaaS, and retail while maintaining financial services targeting, indicating either targeting optimization or multiple coordinated operations
Campaign Overview
Mimecast Threat Research Team has identified threat actors weaponizing social causes, specifically Pride Month and diversity initiatives, to manipulate organizations into hasty actions. These campaigns deliberately misuse legitimate organizational values to generate the urgency attackers need for successful credential theft.
This tactic is particularly effective because it exploits genuine organizational commitment to diversity and inclusion. Whether recipients support or oppose the initiative, attackers count on either reaction driving engagement with malicious links without sufficient scrutiny.
Notably, this campaign launched in mid-December, months before Pride Month in June. This suggests threat actors are planning ahead or testing messaging that will resonate with future campaigns. The timing also coincides with year-end holiday schedules when many organizations operate with reduced IT staffing and security monitoring, conditions that favor phishing success.
Campaign Attribution
- Exploitation of legitimate email service provider infrastructure
- Domain naming conventions mimicking trusted services
- Focus on credential harvesting to enable downstream attacks
- Targeting enterprise organizations across multiple sectors
Please click here to read the entire article. We welcome your questions; please ask them by posting a comment below.
Dimakatso Makinta
