Kaspersky has detected a multi-stage phishing attack targeting manufacturing facilities in Europe, Asia and the Middle East

Kaspersky experts have uncovered a phishing campaign targeting manufacturing facilities in multiple countries, including Malaysia, Egypt, the Czech Republic and Russia.

The attackers are sending English-language emails, allegedly from potential customers interested in respective products, attempting to extort corporate data.

The campaign began in April 2026 and is still ongoing.

The phishing scheme includes several stages.

First, potential victims receive an email from an alleged interested buyer asking for clarification on the product, such as the exact pricing or availability.

If the recipient responds, they are then sent a link to download a file with the product's technical specifications, either immediately in a subsequent email or after further discussion and questions.

Clicking on the link takes the user to the next phishing page mimicking a popular cloud service for working with PDF documents.

The user is then directed to an "authorization form" asking for corporate email address and password – allegedly for security purposes to prevent unauthorized access to the file.

In reality, this is a ploy by attackers to trick users into revealing corporate data.

"We see spear phishing campaigns evolving. Attackers are increasingly moving from simple schemes to complex campaigns consisting of multiple stages, as this increases the chances of a successful attack.

They also thoroughly prepare, researching organizations to craft the most convincing cover stories.

For example, they develop attack scenarios tailored to the specific operating conditions of manufacturing companies.

Attackers often employ AI tools to craft phishing emails or automate other processes.

To reduce risks, organizations need to pay increased attention to security – implementing reliable technical tools and improving employees' cyber literacy," comments Roman Dedenok, Anti-Spam Expert at Kaspersky.

To defend organizations against this threat, Kaspersky recommends: Deploying a proven mail server security solution such as Kaspersky Security for Mail Server that provides secure corporate email exchange, countering spam, email-borne infections, all forms of phishing, business email compromise (BEC), QR code attacks, and other threats.

Providing cybersecurity teams with up-to-date information on the latest tactics, techniques and procedures of attackers by using Kaspersky Threat Intelligence services. Improving employees’ cyber literacy through specialized courses or training, such as those on the Kaspersky Automated Security Awareness Platform.

Photo caption - A phishing page tricking users into submitting corporate credentials.