Threat reportPhishingTL-2026-5665
Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees
Seasonal phishing and BEC activity aimed at employees ahead of Black Friday 2026: fake shipping notices (including QR-code lures), link-less order confirmations with callback numbers, abuse of PayPal's subscription feature, executive gift-card requests, year-end invoice/payment-change BEC, fake HR/benefits notices and charity fraud. First disclosed .
Key facts
| Identifiers | TL-2026-5665 |
|---|---|
| Also known as | Black Friday phishing, Holiday phishing season, O-UNC-037, Executive impersonation invoice fraud |
| Severity | MEDIUM |
| First disclosed | |
| Affected products | Multiple Enterprise email and SMS users (Microsoft 365, Google Workspace); Okta Okta SSO sign-in (impersonated by AiTM pages); PayPal PayPal Subscriptions notification emails (abused for fake purchase notices) |
| MITRE ATT&CK techniques | T1036 Masquerading, T1111 Multi-Factor Authentication Interception, T1204.001 User Execution: Malicious Link, T1219 Remote Access Tools, T1539 Steal Web Session Cookie, T1557 Adversary-in-the-Middle, T1564.008 Hide Artifacts: Email Hiding Rules, T1566 Phishing, T1566.001 Phishing: Spearphishing Attachment, T1566.002 Phishing: Spearphishing Link, T1566.003 Phishing: Spearphishing via Service, T1566.004 Phishing: Spearphishing Voice and 7 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | enterprise, finance, accounts-payable, higher education, technology, industrial-supply, retail, health |
| Target regions | North America, Europe |
| Detection rules | 9 (1 shown free) |
| Sources | 9 cited sources |
Detection coverage
As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5665 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Holiday Phishing / Executive-Impersonation Invoice Fraud - IOC and Lookalike Sender Delivery (Splunk)
Detects inbound mail in the Office 365 message trace from the TL-2026-5665 sender infrastructure (service-nowinc.com, domainlify.net, duobenefits.com, mailsafe365.com, and the third-party relay senders named by Microsoft/Okta), or from ServiceNow/benefits-portal lookalike domains whose subject carries invoice, ACH, gift-card, direct-deposit or benefits language. Covers the CEO-impersonation ServiceNow invoice campaign and the O-UNC-037 ADP Benefits lures that precede AiTM credential theft and payment diversion.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1566, T1566.003, T1656, T1583.001, T1585.002, T1657
- Data sources: Office 365 message trace (index=email, sourcetype=ms:o365:reporting:messagetrace), Microsoft Defender for Office 365 (EmailEvents), Microsoft 365 Exchange Online
- Severity: high
- Confidence: high
Splunk SPL
index=email sourcetype="ms:o365:reporting:messagetrace" earliest=-24h
| eval sender_addr=lower(SenderAddress), sender_domain=lower(mvindex(split(SenderAddress,"@"),1))
| eval ioc_domain_hit=if(match(sender_domain,"^(service-nowinc[.]com|domainlify[.]net|duobenefits[.]com|mailsafe365[.]com|bbcpaglomoonlight[.]studio)$"),1,0)
| eval ioc_sender_hit=if(match(sender_addr,"^(notifications@uinsure[.]co[.]uk|info@tivityhealth[.]com|no-reply@lumalisboa[.]com|gomez@service-nowinc[.]com|receipt3@bbcpaglomoonlight[.]studio)$"),1,0)
| eval lookalike_hit=if(match(sender_domain,"(service-?now[a-z0-9-]*inc|benefits?-?(alerts|app|portal|access)|workforce-?portal)") AND NOT match(sender_domain,"^(servicenow|service-now)[.]com$"),1,0)
| eval bec_subject_hit=if(match(lower(Subject),"(invoice|payment (change|update)|wire|gift ?card|annual subscription|direct deposit|benefits|bonus)"),1,0)
| where ioc_domain_hit=1 OR ioc_sender_hit=1 OR (lookalike_hit=1 AND bec_subject_hit=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(Subject) as subjects values(RecipientAddress) as recipients by sender_addr, sender_domain, ioc_domain_hit, ioc_sender_hit, lookalike_hit
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
let iocDomains = dynamic(['service-nowinc.com','domainlify.net','duobenefits.com','mailsafe365.com','bbcpaglomoonlight.studio']);
let iocSenders = dynamic(['notifications@uinsure.co.uk','info@tivityhealth.com','no-reply@lumalisboa.com','gomez@service-nowinc.com','receipt3@bbcpaglomoonlight.studio']);
EmailEvents
| where Timestamp > ago(24h)
| where EmailDirection == 'Inbound'
| extend SenderDomain = tolower(SenderFromDomain), MailFromDomain = tolower(SenderMailFromDomain), SenderAddr = tolower(SenderFromAddress)
| extend IocDomainHit = SenderDomain in (iocDomains) or MailFromDomain in (iocDomains), IocSenderHit = SenderAddr in (iocSenders), LookalikeHit = SenderDomain matches regex @'(service-?now[a-z0-9-]*inc|benefits?-?(alerts|app|portal|access)|workforce-?portal)' and SenderDomain !in ('servicenow.com','service-now.com'), BecSubjectHit = tolower(Subject) matches regex @'(invoice|payment (change|update)|wire|gift ?card|annual subscription|direct deposit|benefits|bonus)'
| where IocDomainHit or IocSenderHit or (LookalikeHit and BecSubjectHit)
| project Timestamp, NetworkMessageId, SenderAddr, SenderDomain, MailFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, IocDomainHit, IocSenderHit, LookalikeHit, BecSubjectHitSigma
title: TL-2026-5665 Holiday Phishing and Executive Invoice Fraud Sender Infrastructure
id: 5b0e3c1a-7d42-4f6e-9a18-2c6d1e5f8a01
status: experimental
description: Detects inbound mail from sender domains and addresses tied to the CEO-impersonation ServiceNow invoice campaign (Microsoft, 2026-09-10) and the O-UNC-037 employee-benefits phishing campaign (Okta).
references:
- https://microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud
- https://www.okta.com/blog/threat-intelligence/phishing-campaigns-use-employee-benefits-lure-logins/
- https://www.doppel.com/blog/holiday-phishing-scams
author: Threadlinqs Team
date: 2026-11-10
tags:
- attack.initial-access
- attack.t1566
- attack.t1566.003
- attack.defense-evasion
- attack.t1656
- attack.resource-development
- attack.t1583.001
- attack.t1585.002
- attack.impact
- attack.t1657
logsource:
product: m365
service: exchange
detection:
selection_domain:
SenderAddress|endswith:
- '@service-nowinc.com'
- '@domainlify.net'
- '@duobenefits.com'
- '@mailsafe365.com'
- '@bbcpaglomoonlight.studio'
selection_sender:
SenderAddress:
- 'notifications@uinsure.co.uk'
- 'info@tivityhealth.com'
- 'no-reply@lumalisboa.com'
condition: 1 of selection_*
falsepositives:
- Legitimate mail from uinsure.co.uk, tivityhealth.com or lumalisboa.com (abused third-party senders) that is unrelated to the campaign
- Security team phishing simulations or threat-intel sandbox submissions
level: high
Known false positives:
- Legitimate email from uinsure.co.uk, tivityhealth.com or lumalisboa.com that are third-party senders abused by the campaign
- Vendors with genuine invoice or benefits notices from domains that resemble the lookalike regex
- Security-awareness phishing simulations
Tuning notes: Exact-IOC hits are high fidelity; lookalike-plus-subject hits are medium and should be triaged against the vendor allow-list. Allow-list legitimate ServiceNow and benefits-provider domains, add the sender addresses of approved phishing simulations, and refresh the IOC lists from the Microsoft and Okta advisories.
- Executive-Impersonation Invoice Fraud and Benefits Phishing Delivery - Defender for Office 365 (KQL) · unlock with TL Creds
- Inbox Rules Concealing Payroll and Payment Mail - Defender for Cloud Apps (KQL) · unlock with TL Creds
- Remote Access Software Launched After Callback-Phishing Lure - Defender for Endpoint (KQL) · unlock with TL Creds
- Sigma - Executive Invoice Fraud and Benefits Phishing Sender Infrastructure (M365) · unlock with TL Creds
- Sigma - Inbox Rule Hiding Payroll, Bank or Invoice Mail (M365) · unlock with TL Creds
- Sigma - DNS Resolution of Holiday Phishing Redirector and Lure Domains (Sysmon) · unlock with TL Creds
- Mailbox Rules Hiding Payroll, Direct-Deposit or Bank Mail After Account Takeover (Splunk) · unlock with TL Creds
- Web Access to O-UNC-037 AiTM Proxy and Benefits Phishing Infrastructure (Splunk) · unlock with TL Creds
Indicators of compromise
As of 2026-11-10, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5665.
Sample indicators (3 of 30)
- IP address:
173.0.84[.]4 - Domain:
service-nowinc[.]com - Domain:
domainlify[.]net
Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.
Technical analysis
The lures are increasingly AI-assisted, with clean grammar that undermines typo-based awareness training.
Doppel's holiday-season advisory (author Sameera Kelkar; publication date not stated on the page) catalogs six employee-facing scam types that exploit seasonal retail and shipping email volume, year-end financial deadlines and holiday staffing gaps: (1) fake shipping/delivery notices linking to spoofed carrier pages that harvest credentials or card data, some using QR codes (quishing) to move the victim onto an unmanaged personal phone; (2) Black Friday deal and order-confirmation scams, including link-less emails that carry only a toll-free callback number, where fake support agents request credentials and card data or instruct victims to install remote-access software; (3) executive gift-card and 'urgent favor' requests from spoofed CEOs or HR directors; (4) vendor invoice and payment-change BEC timed to year-end close; (5) fake HR notices about bonuses, benefits or holiday schedules; and (6) charity fraud, particularly requests for gift cards or wire transfers.
The article's claims are corroborated by primary vendor reporting. Microsoft (Sept 10, 2026) documented a campaign of more than one million emails sent Aug 3-5, 2026 (about 87.7% to US recipients) that impersonated CEOs, CFOs and presidents to push accounts-payable staff to release a roughly $50,000 ACH payment against a fabricated ServiceNow annual-subscription invoice and a forged forwarded email thread. The lookalike domain service-nowinc.com and reply-to domain domainlify.net were both registered on July 31, 2026, and mail was relayed through multiple third-party email-service accounts. Microsoft saw indicators consistent with AI-assisted drafting (verbose HTML comments, structured labels, uniform templates) but stated it cannot independently establish how much content AI generated.
Okta Threat Intelligence tracks the O-UNC-037 employee-benefits campaign (first published Oct 21, 2025; SMS wave added July 15, 2026). Emails and texts impersonating ADP Benefits, a 'Secure Mail' sender and HR departments lead through redirector domains to adversary-in-the-middle (AiTM) proxies mimicking Microsoft and Okta sign-in pages, behind a Cloudflare CAPTCHA, capturing passwords, MFA codes and session cookies; Cloudflare Workers and redirector layers allow rapid page replacement after takedowns. Microsoft (Oct 9, 2025) separately documented Storm-2657 'payroll pirate' activity against US university employees, in which stolen credentials were used to change HR-platform direct-deposit details while inbox rules hid payroll notification emails.
BleepingComputer (Dec 14, 2025) reported scammers abusing PayPal's Subscriptions feature: fake purchase text and a callback number placed in the Customer Service URL field was delivered inside PayPal's genuine 'payment no longer active' email from service@paypal.com, passing SPF, DKIM and DMARC. PayPal stated it was actively mitigating. Unit 42 published a list of 23 Black Friday-scam domains on Nov 25, 2025. No CVE, named holiday-campaign actor or malware family applies; this record is TTP-focused, low-attribution intelligence. Statistics quoted by Doppel (54% vs 12% click-through for AI-automated phishing per the Microsoft Digital Defense Report 2025; 60% of 2024 breaches involving a human element per Verizon DBIR 2025) are secondhand and vendor-cited.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1036 Masquerading; T1564.008 Hide Artifacts: Email Hiding Rules; T1684.001 Impersonation
Credential Access
T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Execution
T1204.001 User Execution: Malicious Link
Command and Control
Initial Access
T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link; T1566.003 Phishing: Spearphishing via Service; T1566.004 Phishing: Spearphishing Voice
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1585.002 Establish Accounts: Email Accounts; T1586.002 Compromise Accounts: Email Accounts
Reconnaissance
T1598 Phishing for Information
Impact
Remediation
Immediate actions
- Require out-of-band verification (call a number already on file) for payment-change, ACH, gift-card and direct-deposit requests, with a second sign-off for new bank details
- Block or hunt for the published domains and sender addresses in mail, proxy and DNS logs
- Enable Zero-hour Auto Purge and automatic attack disruption; configure SPF, DKIM and DMARC and enhanced filtering for third-party mail connectors
- Alert on mailbox rules that delete or hide messages matching payroll, direct deposit or bank keywords
- Make reporting of suspicious messages one-click and triage reported mail
Workarounds
- Type carrier, HR portal and benefits URLs directly rather than following email or SMS links
- Do not scan QR codes received in work email; keep personal shopping and delivery accounts off work email
- Do not call phone numbers embedded in purchase or payment notifications; verify in the vendor's app or website
Longer-term hardening
- Deploy phishing-resistant authentication (FIDO2/passkeys, Okta FastPass) to defeat AiTM credential and session theft
- Restrict sensitive apps to managed devices and apply network zones/conditional access for rarely used networks
- Detect link-less lures by analysing what a message asks the recipient to do, not only links and attachments
- Run holiday phishing simulations based on live lures and retire typo-based awareness cues
Affected and fixed versions
- Multiple — Enterprise email and SMS users (Microsoft 365, Google Workspace)
Vulnerable versions: All - Okta — Okta SSO sign-in (impersonated by AiTM pages)
Vulnerable versions: Tenants without phishing-resistant authenticators - PayPal — PayPal Subscriptions notification emails (abused for fake purchase notices)
Vulnerable versions: Pre-mitigation behaviour observed Dec 2025
Fixed in: Loophole reported closed Dec 2025
Timeline
- Microsoft publishes Storm-2657 'payroll pirate' findings: stolen credentials used to alter HR-platform direct-deposit details at US universities, with inbox rules hiding payroll notifications.
- Okta Threat Intelligence first publishes O-UNC-037 employee-benefits phishing (decoded token timestamp about 2025-10-20), using email lures that lead to AiTM Microsoft/Okta sign-in pages.
- Unit 42 publishes a list of 23 domains used for Black Friday scams (14 phishing-email domains, 9 redirection/phishing-site domains).
- BleepingComputer reports scammers abusing PayPal Subscriptions to send genuine PayPal emails carrying fake purchase text and a callback number; PayPal says it is mitigating and the loophole is later reported closed.
- Okta updates its O-UNC-037 report to add an SMS lure wave (benefits/compensation-change texts with links).
- Lookalike domain locked-ioc-17 and reply-to domain locked-ioc-24 are registered ahead of the CEO-impersonation invoice campaign.
- Start of a three-day campaign (through Aug 5) of more than one million emails impersonating CEOs/CFOs/presidents and requesting an ACH payment of nearly $50,000 against a fake ServiceNow invoice; about 87.7% sent to US users.
- Microsoft publishes its analysis of the AI-assisted executive impersonation and invoice fraud campaign, with IOCs and mitigation guidance.
- Black Friday 2026: Doppel advises security teams to have link-less-lure detection, out-of-band payment verification, simulations, one-click reporting and takedown processes in place before this date.
Sources cited
- Protecting organizations from AI-assisted executive impersonation and invoice fraud (Microsoft Security Blog) Microsoft · Vendor report · 2026-09-10
- Phishing campaigns use employee-benefits lure to harvest logins (Okta Threat Intelligence, O-UNC-037) okta.com · Vendor report · 2025-10-21
- Black Friday Cyber Crime Economy: Surge in Fraudulent Domains and eCommerce Scams (Check Point Research) Check Point · Research · 2025-11-20
- Domains Used for Black Friday Scams (Unit 42 timely threat intel) GitHub · Code repository · 2025-11-25
- Holiday Phishing Scams 2026: What to Warn Employees About (Doppel, Sameera Kelkar) doppel.com · Blog
- Beware: PayPal subscriptions abused to send fake purchase emails (BleepingComputer) BleepingComputer · News · 2025-12-14
- Microsoft warns of 'payroll pirate' crew looting US university salaries (The Register) The Register · News · 2025-10-10
- PayPal closes loophole that let scammers send real emails with fake purchase notices (Malwarebytes) malwarebytes.com · News · 2025-12-15
- Hackers Send 1 Million AI-Assisted CEO Impersonation Emails in Invoice Fraud Campaign (Cyberpress) cyberpress.org · News · 2026-09-11
Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.
