A new phishing campaign targeting transportation and logistics companies in North America has been identified by cybersecurity researchers. This campaign, active since May 2024, uses compromised legitimate email accounts from the transportation sector to distribute a variety of malware strains, including Lumma Stealer, StealC, DanaBot, and Arechclient2. The threat actors inject malicious content into existing email conversations, making their lures more convincing and difficult to detect. Researchers noted that at least fifteen (15) email accounts have been compromised, although the exact method of infiltration remains unclear. In August 2024, the attackers shifted tactics, employing new infrastructure, delivery methods, and additional payloads. One of the techniques involves sending messages with internet shortcut (.URL) attachments or Google Drive URLs that lead to .URL files. When launched, these files use Server Message Block (SMB) to fetch the next-stage malware payload from a remote location. Additionally, some variants of the campaign have used a technique called ClickFix, which tricks victims into downloading the DanaBot malware by urging them to copy and paste a Base64-encoded PowerShell script into their terminal. The attackers have impersonated software solutions like Samsara, AMB Logistic, and Astra TMS, which are specific to transport and fleet management, indicating that they are likely conducting thorough research on their targets before launching their attacks. The emergence of this campaign comes amidst a rise in various stealer malware strains and follows the discovery of a new version of the RomCom remote access trojan (RAT), called SnipBot. Distributed via phishing emails, SnipBot allows attackers to execute commands, download additional modules, and manipulate files on the victim’s system. Overall, this campaign highlights the evolving tactics of financially motivated threat actors who tailor their lures to specific industries, leveraging compromised email accounts to increase the authenticity of their attacks. CTIX analysts recommend heightened cybersecurity vigilance from organizations in the transportation and logistics sectors.