NCSC and partners expose "zero-click" phishing campaign aimed at Western organisations

The National Cyber Security Centre has repeated its warning about a credential-harvesting campaign that needs no click to begin working: the preview itself renders a convincing login prompt, and the target is finance and payroll staff at small firms.

What the campaign does

The message arrives as a shared-document or voicemail notification from an address inside a supplier's real thread. The harvested credentials are used to read mail rather than to move money directly. That reading stage is the point: the operator learns invoice cycles, tone of voice and who signs off payments, then waits for a genuine invoice to change the bank details on it.

• Targets are chosen for access to payment approvals, not seniority.
• Mailbox rules are added to hide replies from the real supplier.
• The fraudulent payment request arrives inside an existing, genuine thread.

Why consumers should care

Households meet the same operation at the other end. A conveyancing payment, a builder's final invoice or a school trip payment arrives with new account details from an address that has been correct for months. The loss lands on the payer, and the claim is made to the payer's bank under the reimbursement rules.

Practical steps

1. Turn on multi-factor authentication on email before anything else.
2. Never accept changed bank details by email; ring the number you already have.
3. Check mailbox rules and forwarding settings for entries you did not create.
4. Report suspicious emails to the national suspicious email service; texts go to 7726.

If a payment has gone, call your bank, report to Action Fraud, and if the bank refuses, take it to the Financial Ombudsman Service. The FCA consumer helpline is 0800 111 6768. Source: NCSC news; headline, summary and link only.