# Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees

> Seasonal phishing and BEC activity aimed at employees ahead of Black Friday 2026: fake shipping notices (including QR-code lures), link-less order confirmations with callback numbers, abuse of PayPal's subscription feature, executive gift-card requests, year-end invoice/payment-change BEC, fake HR/benefits notices and charity fraud. The lures are increasingly AI-assisted, with clean grammar that undermines typo-based awareness training.

- **Published:** 2026-11-10T17:29:49Z
- **Last reviewed:** 2026-11-10T17:29:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5665
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5665.png
- **ID:** TL-2026-5665
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Doppel's holiday-season advisory (author Sameera Kelkar; publication date not stated on the page) catalogs six employee-facing scam types that exploit seasonal retail and shipping email volume, year-end financial deadlines and holiday staffing gaps: (1) fake shipping/delivery notices linking to spoofed carrier pages that harvest credentials or card data, some using QR codes (quishing) to move the victim onto an unmanaged personal phone; (2) Black Friday deal and order-confirmation scams, including link-less emails that carry only a toll-free callback number, where fake support agents request credentials and card data or instruct victims to install remote-access software; (3) executive gift-card and 'urgent favor' requests from spoofed CEOs or HR directors; (4) vendor invoice and payment-change BEC timed to year-end close; (5) fake HR notices about bonuses, benefits or holiday schedules; and (6) charity fraud, particularly requests for gift cards or wire transfers.

The article's claims are corroborated by primary vendor reporting. Microsoft (Sept 10, 2026) documented a campaign of more than one million emails sent Aug 3-5, 2026 (about 87.7% to US recipients) that impersonated CEOs, CFOs and presidents to push accounts-payable staff to release a roughly $50,000 ACH payment against a fabricated ServiceNow annual-subscription invoice and a forged forwarded email thread. The lookalike domain service-nowinc.com and reply-to domain domainlify.net were both registered on July 31, 2026, and mail was relayed through multiple third-party email-service accounts. Microsoft saw indicators consistent with AI-assisted drafting (verbose HTML comments, structured labels, uniform templates) but stated it cannot independently establish how much content AI generated.

Okta Threat Intelligence tracks the O-UNC-037 employee-benefits campaign (first published Oct 21, 2025; SMS wave added July 15, 2026). Emails and texts impersonating ADP Benefits, a 'Secure Mail' sender and HR departments lead through redirector domains to adversary-in-the-middle (AiTM) proxies mimicking Microsoft and Okta sign-in pages, behind a Cloudflare CAPTCHA, capturing passwords, MFA codes and session cookies; Cloudflare Workers and redirector layers allow rapid page replacement after takedowns. Microsoft (Oct 9, 2025) separately documented Storm-2657 'payroll pirate' activity against US university employees, in which stolen credentials were used to change HR-platform direct-deposit details while inbox rules hid payroll notification emails.

BleepingComputer (Dec 14, 2025) reported scammers abusing PayPal's Subscriptions feature: fake purchase text and a callback number placed in the Customer Service URL field was delivered inside PayPal's genuine 'payment no longer active' email from service@paypal.com, passing SPF, DKIM and DMARC. PayPal stated it was actively mitigating. Unit 42 published a list of 23 Black Friday-scam domains on Nov 25, 2025. No CVE, named holiday-campaign actor or malware family applies; this record is TTP-focused, low-attribution intelligence. Statistics quoted by Doppel (54% vs 12% click-through for AI-automated phishing per the Microsoft Digital Defense Report 2025; 60% of 2024 breaches involving a human element per Verizon DBIR 2025) are secondhand and vendor-cited.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1585.002 Establish Accounts: Email Accounts
- T1586.002 Compromise Accounts: Email Accounts
- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1566.002 Phishing: Spearphishing Link
- T1566.003 Phishing: Spearphishing via Service
- T1566.004 Phishing: Spearphishing Voice
- T1204.001 User Execution: Malicious Link
- T1036 Masquerading
- T1684.001 Impersonation
- T1564.008 Hide Artifacts: Email Hiding Rules
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1219 Remote Access Tools
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Holiday Phishing / Executive-Impersonation Invoice Fraud - IOC and Lookalike Sender Delivery (Splunk)** (`TL-2026-5665-SPL-001`)

Detects inbound mail in the Office 365 message trace from the TL-2026-5665 sender infrastructure (service-nowinc.com, domainlify.net, duobenefits.com, mailsafe365.com, and the third-party relay senders named by Microsoft/Okta), or from ServiceNow/benefits-portal lookalike domains whose subject carries invoice, ACH, gift-card, direct-deposit or benefits language. Covers the CEO-impersonation ServiceNow invoice campaign and the O-UNC-037 ADP Benefits lures that precede AiTM credential theft and payment diversion.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566, T1566.003, T1656, T1583.001, T1585.002, T1657
- **Data sources:** Office 365 message trace (index=email, sourcetype=ms:o365:reporting:messagetrace), Microsoft Defender for Office 365 (EmailEvents), Microsoft 365 Exchange Online
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=email sourcetype="ms:o365:reporting:messagetrace" earliest=-24h
| eval sender_addr=lower(SenderAddress), sender_domain=lower(mvindex(split(SenderAddress,"@"),1))
| eval ioc_domain_hit=if(match(sender_domain,"^(service-nowinc[.]com|domainlify[.]net|duobenefits[.]com|mailsafe365[.]com|bbcpaglomoonlight[.]studio)$"),1,0)
| eval ioc_sender_hit=if(match(sender_addr,"^(notifications@uinsure[.]co[.]uk|info@tivityhealth[.]com|no-reply@lumalisboa[.]com|gomez@service-nowinc[.]com|receipt3@bbcpaglomoonlight[.]studio)$"),1,0)
| eval lookalike_hit=if(match(sender_domain,"(service-?now[a-z0-9-]*inc|benefits?-?(alerts|app|portal|access)|workforce-?portal)") AND NOT match(sender_domain,"^(servicenow|service-now)[.]com$"),1,0)
| eval bec_subject_hit=if(match(lower(Subject),"(invoice|payment (change|update)|wire|gift ?card|annual subscription|direct deposit|benefits|bonus)"),1,0)
| where ioc_domain_hit=1 OR ioc_sender_hit=1 OR (lookalike_hit=1 AND bec_subject_hit=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(Subject) as subjects values(RecipientAddress) as recipients by sender_addr, sender_domain, ioc_domain_hit, ioc_sender_hit, lookalike_hit
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let iocDomains = dynamic(['service-nowinc.com','domainlify.net','duobenefits.com','mailsafe365.com','bbcpaglomoonlight.studio']);
let iocSenders = dynamic(['notifications@uinsure.co.uk','info@tivityhealth.com','no-reply@lumalisboa.com','gomez@service-nowinc.com','receipt3@bbcpaglomoonlight.studio']);
EmailEvents
| where Timestamp > ago(24h)
| where EmailDirection == 'Inbound'
| extend SenderDomain = tolower(SenderFromDomain), MailFromDomain = tolower(SenderMailFromDomain), SenderAddr = tolower(SenderFromAddress)
| extend IocDomainHit = SenderDomain in (iocDomains) or MailFromDomain in (iocDomains), IocSenderHit = SenderAddr in (iocSenders), LookalikeHit = SenderDomain matches regex @'(service-?now[a-z0-9-]*inc|benefits?-?(alerts|app|portal|access)|workforce-?portal)' and SenderDomain !in ('servicenow.com','service-now.com'), BecSubjectHit = tolower(Subject) matches regex @'(invoice|payment (change|update)|wire|gift ?card|annual subscription|direct deposit|benefits|bonus)'
| where IocDomainHit or IocSenderHit or (LookalikeHit and BecSubjectHit)
| project Timestamp, NetworkMessageId, SenderAddr, SenderDomain, MailFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, IocDomainHit, IocSenderHit, LookalikeHit, BecSubjectHit
```

### Sigma

```yaml
title: TL-2026-5665 Holiday Phishing and Executive Invoice Fraud Sender Infrastructure
id: 5b0e3c1a-7d42-4f6e-9a18-2c6d1e5f8a01
status: experimental
description: Detects inbound mail from sender domains and addresses tied to the CEO-impersonation ServiceNow invoice campaign (Microsoft, 2026-09-10) and the O-UNC-037 employee-benefits phishing campaign (Okta).
references:
  - https://microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud
  - https://www.okta.com/blog/threat-intelligence/phishing-campaigns-use-employee-benefits-lure-logins/
  - https://www.doppel.com/blog/holiday-phishing-scams
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.initial-access
  - attack.t1566
  - attack.t1566.003
  - attack.defense-evasion
  - attack.t1656
  - attack.resource-development
  - attack.t1583.001
  - attack.t1585.002
  - attack.impact
  - attack.t1657
logsource:
  product: m365
  service: exchange
detection:
  selection_domain:
    SenderAddress|endswith:
      - '@service-nowinc.com'
      - '@domainlify.net'
      - '@duobenefits.com'
      - '@mailsafe365.com'
      - '@bbcpaglomoonlight.studio'
  selection_sender:
    SenderAddress:
      - 'notifications@uinsure.co.uk'
      - 'info@tivityhealth.com'
      - 'no-reply@lumalisboa.com'
  condition: 1 of selection_*
falsepositives:
  - Legitimate mail from uinsure.co.uk, tivityhealth.com or lumalisboa.com (abused third-party senders) that is unrelated to the campaign
  - Security team phishing simulations or threat-intel sandbox submissions
level: high

```

**Known false positives:**

- Legitimate email from uinsure.co.uk, tivityhealth.com or lumalisboa.com that are third-party senders abused by the campaign
- Vendors with genuine invoice or benefits notices from domains that resemble the lookalike regex
- Security-awareness phishing simulations

**Tuning notes:** Exact-IOC hits are high fidelity; lookalike-plus-subject hits are medium and should be triaged against the vendor allow-list. Allow-list legitimate ServiceNow and benefits-provider domains, add the sender addresses of approved phishing simulations, and refresh the IOC lists from the Microsoft and Okta advisories.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Executive-Impersonation Invoice Fraud and Benefits Phishing Delivery - Defender for Office 365 (KQL) (locked: unlock with TL Creds)
- Inbox Rules Concealing Payroll and Payment Mail - Defender for Cloud Apps (KQL) (locked: unlock with TL Creds)
- Remote Access Software Launched After Callback-Phishing Lure - Defender for Endpoint (KQL) (locked: unlock with TL Creds)
- Sigma - Executive Invoice Fraud and Benefits Phishing Sender Infrastructure (M365) (locked: unlock with TL Creds)
- Sigma - Inbox Rule Hiding Payroll, Bank or Invoice Mail (M365) (locked: unlock with TL Creds)
- Sigma - DNS Resolution of Holiday Phishing Redirector and Lure Domains (Sysmon) (locked: unlock with TL Creds)
- Mailbox Rules Hiding Payroll, Direct-Deposit or Bank Mail After Account Takeover (Splunk) (locked: unlock with TL Creds)
- Web Access to O-UNC-037 AiTM Proxy and Benefits Phishing Infrastructure (Splunk) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `173.0.84[.]4`
- Domain: `service-nowinc[.]com`
- Domain: `domainlify[.]net`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Holiday Phishing Scams 2026: What to Warn Employees About (Doppel, Sameera Kelkar)](https://www.doppel.com/blog/holiday-phishing-scams)
- [Protecting organizations from AI-assisted executive impersonation and invoice fraud (Microsoft Security Blog)](https://microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud)
- [Phishing campaigns use employee-benefits lure to harvest logins (Okta Threat Intelligence, O-UNC-037)](https://www.okta.com/blog/threat-intelligence/phishing-campaigns-use-employee-benefits-lure-logins/)
- [Beware: PayPal subscriptions abused to send fake purchase emails (BleepingComputer)](https://www.bleepingcomputer.com/news/security/beware-paypal-subscriptions-abused-to-send-fake-purchase-emails/)
- [Domains Used for Black Friday Scams (Unit 42 timely threat intel)](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel)
- [Microsoft warns of 'payroll pirate' crew looting US university salaries (The Register)](https://www.theregister.com/2025/10/10/microsoft_payroll_pirate/)
- [PayPal closes loophole that let scammers send real emails with fake purchase notices (Malwarebytes)](https://www.malwarebytes.com/blog/news/2025/12/paypal-closes-loophole-that-let-scammers-send-real-emails-with-fake-purchase-notices)
- [Hackers Send 1 Million AI-Assisted CEO Impersonation Emails in Invoice Fraud Campaign (Cyberpress)](https://cyberpress.org/ai-ceo-invoice-fraud/)
- [Black Friday Cyber Crime Economy: Surge in Fraudulent Domains and eCommerce Scams (Check Point Research)](https://blog.checkpoint.com/research/the-black-friday-cyber-crime-economy-surge-in-fraudulent-domains-and-ecommerce-scams/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5665