Since April 2025, the campaign has been opportunistically targeting entities in Albania, Austria, Bulgaria, Germany, Greece, Hungary, Ireland, Israel, Italy, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and the United Kingdom.

A sophisticated phishing campaign has been actively targeting users in France since March 2024. The campaign leverages leaked personal data to craft convincing spearphishing emails impersonating Amazon Prime renewal notices.

Based on our technical analysis of the campaign, researchers believe it is sold as part of a phishing-as-a-service kit that enables different threat actors to leverage the same infrastructure.