Quick Summary
From June 2024 to December 2025, Fortra analysts tracked a business email compromise operation named Scripted Sparrow. This group executed targeted phishing campaigns, sending between 10,000 and 50,000 emails daily, using fake invoices to mislead finance teams into transferring funds. They employed a structured approach, utilizing 512 unique variants and 249 identified bank accounts, primarily targeting companies in North America and Europe. Understanding these tactics is crucial for organizations to protect against financial fraud.
The Securityish Brief
Scripted Sparrow, a persistent business email compromise group, was first identified in June 2024. Their campaigns involved sending convincing fake invoices to companies across North America and Europe, often including forged email trails and executive approvals to enhance credibility. By early 2025, analysts confirmed the group’s operations across various industries, cataloging 512 unique variants of their phishing attempts.
The group operates with a structured approach, employing defined roles for research, email crafting, and financial coordination. They register lookalike domains and craft messages that mimic internal communications, often using fictitious company names like Catalyst Executive Circle. Their invoices typically list amounts just below approval thresholds, making it easier for targets to process payments without additional scrutiny.
Despite their low technical sophistication, Scripted Sparrow’s campaigns are marked by consistency in language and formatting, which helps them evade detection. Their operational tactics include reconnaissance to gather public details about targets, ensuring their emails appear authentic. The group has been observed using 249 unique bank accounts across 42 financial institutions, indicating a coordinated laundering network.
Understanding Scripted Sparrow’s methods can help organizations recognize similar threats. Their focus on social engineering rather than malware means that traditional cybersecurity measures may not suffice. Companies need to be vigilant about email communications, especially those requesting payments, and should implement verification protocols to confirm the legitimacy of such requests.
As the group evolves, they have made subtle changes to their tactics, such as updating invoice designs and reusing identities. This adaptability highlights the importance of ongoing education and awareness training for finance teams to recognize linguistic red flags and validate payment requests.
Key Takeaways
- Implement verification protocols for vendor payments to ensure legitimacy before processing.
- Monitor for domain and header anomalies in emails to catch potential phishing attempts.
- Educate finance teams on recognizing linguistic red flags in email communications.
- Utilize behavioral analytics to track deviations in communication patterns that may indicate fraud.
- Encourage a culture of skepticism regarding unsolicited payment requests, especially those that appear urgent.
Key Terms & Concepts
- Business Email Compromise (BEC): In this article, BEC refers to a type of cybercrime where attackers impersonate legitimate businesses to deceive employees into transferring funds.
- Phishing: Phishing is a fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in electronic communications.
- Reconnaissance: Reconnaissance in this context refers to the research phase where attackers gather information about their targets to craft convincing phishing messages.
Read the original article here: https://www.helpnetsecurity.com/2025/12/18/tracking-scripted-sparrow-phishing-campaigns/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
