Reported by 1 outlet
Operation HookedWing — 4+ year phishing campaign steals 2,000+ credentials from 500+ organizations
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Operation HookedWing — 4+ year phishing campaign steals 2,000+ credentials from 500+ organizations
securityweek.com · 156d ago · May 11th, 2026
SOCRadar has documented a sustained credential-harvesting campaign dubbed Operation HookedWing, active since 2022 and still ongoing. The operation has compromised over 2,000 user credentials across 500+ organizations in aviation, energy, government, finance, and critical infrastructure sectors. The campaign operates 24 C2 servers and 100+ GitHub domains, using phishing emails impersonating HR and colleagues to lure victims to personalized Microsoft Outlook login pages hosted on GitHub repositories. The landing pages dynamically pre-fill victim organization names and capture email, password, IP address, full geolocation, source URL, and organization domain in a single record. The infrastructure has evolved significantly: from simple English-language GitHub domains in 2022 to obfuscated multilingual operations with obfuscated domain naming by 2025. Victim selection indicates geopolitical awareness and targeting of environments with access to sensitive information and high-privilege credentials, which are likely sold onward to other threat actors.