A large-scale phishing campaign impersonated UK retailer Boots, using a compromised Bolivian government website to host a fraudulent checkout page and a legitimate bulk mailing application (Gammadyne Mailer) installed on a compromised UK business server to distribute emails. This method masked the attackers' infrastructure by sending directly from the organization's internet connection. The operation, linked to Romanian threat actors and active since July 2025, aimed to steal personal data and is part of a broader ongoing campaign targeting UK consumers.
Email security Fake Boots emails target millions in large phishing campaign June 18, 2026 Share By SC Staff (Adobe Stock) As reported by Tech Radar, millions of UK shoppers were targeted by a massive phishing campaign that used fake emails appearing to be from health and beauty retailer Boots, offering a free beauty sample pack. The operation aimed to collect personal details through a fake customer survey and a fraudulent checkout process. The campaign, involving nearly 8.9 million email addresses and linked to Romanian threat actors, utilized a compromised Bolivian government website to host the fraudulent Boots checkout page. Attackers leveraged a legitimate bulk mailing application, Gammadyne Mailer, installed on a compromised UK business terminal server to distribute the phishing emails. This allowed them to send messages directly from the organization's internet connection, masking their own infrastructure. The compromised server was not used for ransomware or data theft against the business but solely as a platform for sending fraudulent messages. The same phishing toolkit has been observed across multiple compromised systems since July 2025, suggesting a broader, ongoing operation that also includes tax-related and cryptocurrency scams targeting UK consumers. Source: Tech Radar SC Staff Related Email security Stock exchange executive’s Outlook mailbox stolen over course of 5 months Laura French June 4, 2026 The approximately 150-day espionage campaign incrementally exfiltrated emails to cloud services. Email security Doppel launches AI email security to disrupt phishing campaigns SC Staff May 27, 2026 Doppel Email Security utilizes autonomous agents and its Doppel 360 Threat Graph to investigate threats within the inbox. Email security How attackers engineer BECs against specific organizations Mick Leach May 27, 2026 Teams can mitigate BECs by better understanding their company’s attack profile. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Bring Your Own Device (BYOD) Eavesdropping Email Spoofing Internet Message Access Protocol (IMAP) Post Office Protocol, Version 3 (POP3) Spam Store-and-Forward You can skip this ad in 5 seconds