phishtotal.io

Campaign families

Every campaign we identify gets a stable codename like Scarlet Wolf — an adjective plus an animal. The animal is the family, and it tells you the operator's dominant target sector at a glance: a Wolf hunts banks, a Spider spins for inboxes, a Viper strikes crypto wallets. The adjective just keeps each campaign's name unique.

This is modelled on the industry convention of animal-suffixed actor names (CrowdStrike's Bear = Russia, Kitten = Iran). The key difference: our families denote what an operator targets and how they exfiltrate — both directly observed from the kits — not a nation-state attribution.

Spider

Webmail & email
the arachnids
Targets

Webmail and email providers — Microsoft 365, Google, Yahoo. The keys to the inbox.

Tradecraft

Mass credential phishing; harvested inboxes feed BEC and onward account access.

View campaigns →

Wolf

Banking
the canids
Targets

Retail and commercial banks and their online-banking logins.

Tradecraft

Pack-style credential harvesting; high-value account takeover and fraud.

View campaigns →

Vulture

Postal & shipping
the scavenger birds
Targets

Postal and parcel carriers — DHL, USPS, Royal Mail, FedEx.

Tradecraft

“Redelivery fee” lure phishing; card and identity capture at scale.

View campaigns →

Panther

Social & messaging
the big cats
Targets

Social and messaging platforms — Facebook, Instagram, WhatsApp, LinkedIn.

Tradecraft

Profile takeover; impersonation, scam propagation, ad-account abuse.

View campaigns →

Eagle

Cloud & identity
the eagles
Targets

Cloud, identity and productivity SaaS — Adobe, Apple, Dropbox, DocuSign, Okta.

Tradecraft

SSO/identity credential theft; lateral access into connected services.

View campaigns →

Crocodile

E-commerce
the crocodilians
Targets

Online retail and marketplaces — Amazon, eBay, Shopify.

Tradecraft

Shopper-account theft; stored cards, order fraud, marketplace scams.

View campaigns →

Shark

Payments
the sharks
Targets

Payment and money-movement services — PayPal, Stripe, Cash App, Zelle.

Tradecraft

Account takeover for instant transfers; cards and payout details.

View campaigns →

Hornet

Telecom
the stinging insects
Targets

Telecom and mobile carriers — AT&T, Vodafone, Orange, T-Mobile.

Tradecraft

Account & SIM-control phishing; a foothold for SIM-swap and 2FA defeat.

View campaigns →

Wyrm

Streaming & media
the dragons
Targets

Streaming and media subscriptions — Netflix, Spotify, Disney+.

Tradecraft

Subscription-account theft and billing-detail capture; resale fraud.

View campaigns →

Viper

Cryptocurrency
the serpents
Targets

Crypto exchanges and wallets — Coinbase, Binance, MetaMask, Ledger.

Tradecraft

Seed-phrase and wallet-credential theft; irreversible drain of funds.

View campaigns →

Lion

Government & tax
the great cats
Targets

Government and tax services — IRS, HMRC, gov portals, health services.

Tradecraft

Authority-lure phishing; identity, tax and benefit-account fraud.

View campaigns →

Specter

Unclassified
the the unclassified
Targets

Targets we couldn’t confidently map to a sector.

Tradecraft

Mixed or unknown — pending classification as more signal accrues.

View campaigns →