Manipulated Caiman Phishing Campaign Exposes Nearly 40 Million Mexican Email Addresses
What Happened — In July 2023, researchers at Perception Point disclosed a spear‑phishing operation dubbed “Manipulated Caiman.” The campaign sent malicious attachments to Mexican citizens in an attempt to steal banking credentials. The attackers harvested approximately 39,901,389 email addresses, which were later uploaded to Have I Been Pwned for public awareness.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous security‑awareness program that can detect and deter phishing attempts before credentials are compromised.
- Provides a concrete data point for audit evidence that an organization’s phishing‑simulation controls are being exercised and measured.
- Highlights the importance of maintaining up‑to‑date email‑filtering and attachment‑sandboxing controls as part of a defensible control‑assurance posture.
Who Is Affected — Primarily Mexican citizens and any financial‑service providers that may receive fraudulent login attempts from compromised accounts.
Recommended Actions
- Deploy or refresh a security‑awareness training curriculum that includes phishing‑simulation exercises and measurable completion metrics.
- Enforce attachment sandboxing and advanced email‑gateway filtering to block malicious payloads.
- Monitor for anomalous login activity on banking portals and enforce multi‑factor authentication for credential protection.
Source: Perception Point report
Technical Notes
- Attack vector: spear‑phishing emails with malicious attachments.
- No public vulnerability (CVE) disclosed; the threat relied on social engineering rather than software flaws.
- Data type exposed: email addresses (≈ 40 M records).
Source: HIBP breach entry