Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and impersonation can be used to break into corporate cloud environments even when security controls exist.
Apollo Global Management disclosed that attackers gained unauthorized access to certain cloud platforms over several days in July, using social engineering rather than a technical exploit alone. The attackers obtained sensitive personal data, including names, home addresses, dates of birth, and Social Security numbers. Apollo has not publicly attributed the breach or disclosed which cloud platforms were affected or how many people were impacted.
Reporting on the wider campaign this incident is tied to found attackers impersonating IT support personnel and using phishing pages to trick employees into handing over credentials and authentication information. This information could then be used to access corporate cloud environments. The pretext typically centers on a claimed account or authentication issue, directing the employee to a lookalike login page to verify credentials and any MFA or authentication details.
This campaign is not narrowly targeted. Reuters found that attackers had created personalized phishing domains for more than 200 companies, showing how easily this approach can be replicated at scale against enterprises, including financial firms and large organizations that rely on corporate cloud platforms.
Impersonating IT support works because employees are conditioned to comply quickly with requests framed as technical or urgent, especially when the message suggests they might lose account access. A personalized or unfamiliar login domain can go unnoticed under time pressure, and once valid credentials and authentication details are captured, attackers can move into cloud environments even where other security controls exist.
Organizations and employees can reduce risk by treating any unsolicited IT support identity as unverified until confirmed through a known internal channel, such as a directory, ticketing system, or known contact number. Employees should navigate to cloud services through bookmarks or official portals rather than clicking links in messages. Because valid credentials can still be abused, unusual sign-in prompts or authentication requests should be reported promptly so security teams can investigate. Finally, since the effects of a breach can extend beyond the initial intrusion, following company guidance on identity monitoring after notification is an important part of the response.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers used social engineering, impersonating IT support and directing employees to phishing pages that captured credentials and authentication information, which was then used to access corporate cloud environments.
Sensitive personal information was accessed, including names, home addresses, dates of birth, and Social Security numbers.
No. Reporting on the broader campaign found attackers had created personalized phishing domains for more than 200 companies, suggesting a scalable approach used against many enterprises, including financial firms.
Treat unsolicited requests to verify accounts or credentials as untrusted until confirmed through a known internal channel, such as a directory, ticketing portal, or known internal contact number.
Apollo just had a breach because someone trusted the wrong “IT support” message. The message says your access is at risk, pushes you to click a link, then sends you to a perfect-looking login page on a weird, personalized domain. In that Apollo-style campaign, attackers built custom domains for over 200 companies, stole logins and MFA codes, and used them to get into cloud platforms and pull names, addresses, birthdays, even Social Security numbers. If “IT support” ever asks you to log in from a link, stop. Don’t click, open our official portal or SSO bookmark yourself and sign in from there.
A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
Levi Strauss reported that an unauthorized party used social-engineering to compromise three employees’ company-issued computers and steal corporate data. Reporting tied the incident to a wider campaign where attackers impersonated IT help desks using spoofed phone numbers and fraudulent websites…
A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
