It started the way most successful scams do lately: with something that looked completely ordinary. A message on WhatsApp, appearing to come from a senior executive. A confidential company acquisition. A polished, professional-looking NDA from a major consultancy. And then, the ask: an urgent transfer of more than A$1 million to an overseas account.
The employee who received it worked at Gen, the company behind cybersecurity firm Avast, which meant the scammers had, without realising it, picked one of the more difficult targets available. Something about the call felt off, the voice on the other end of the phone didn’t quite sound like the executive it was supposed to be, and rather than proceed, the employee flagged it. From there, Avast’s own researchers took over, playing along with a decoy payment confirmation and a trackable link, using the scam’s own momentum to study how it worked, turning a near-miss into an intelligence-gathering opportunity most targeted companies never get the chance to run.
What they found, dubbed internally “Phantom Deal,” wasn’t a one-off attempt but a full campaign, built with real research rather than guesswork. The scammers had used real executives’ names, photos and professional details. They’d built their story around genuine company history, including Avast’s actual 2022 merger with NortonLifeLock, to make the scenario feel plausible from the inside. They moved the target off internal systems and onto personal WhatsApp and email, away from any oversight, and backed the whole thing with a forged NDA designed to make secrecy feel like a legal obligation rather than a red flag.
Avast later found that the same scammers had used the same template and forged-document fingerprints against at least four other targets across mining, energy, private equity, industrial finance and sales, suggesting a repeatable playbook rather than a single, opportunistic attempt.
None of it relied on malware or a hacked account, which is exactly what makes it worth paying attention to. In Australia alone, payment-redirection scams accounted for $166.8 million in reported losses in 2025, and cases like this one show why the numbers keep climbing: the con isn’t in the technology, it’s in the story, built convincingly enough that bypassing a normal payment process starts to feel reasonable rather than reckless. The rise of realistic voice-cloning and deepfake tools has only made that story easier to tell, closing the gap between “that doesn’t sound quite right” and a voice that’s genuinely difficult to distinguish from the real thing.
For any business handling wire transfers, NDAs or executive-level requests over messaging apps, Phantom Deal is a reminder that the weakest link is rarely the software. It’s the moment someone decides not to ask a second question.
