A complex fraud scheme has been uncovered, involving numerous steps to convince users that an email they received was legitimate and came from Credit Agricole. Researchers found that nearly a thousand victims parted with their banking credentials.

Even though scammers' whole business model relies on digital mistakes, they themselves are far from being immune to slipping up. On June 19th, our research team discovered a publicly accessible server running a major phishing operation impersonating the French bank Credit Agricole.

With revenue exceeding $45 billion (€39.5 billion) and an employee headcount of around 160,000, Credit Agricole is one of the largest financial institutions in Europe, and the world's largest cooperative financial institution.

What this means for scammers, especially in the phishing game, is a big name, with plenty of potential customers to victimize. Because of our research findings, we can take a rare look at how much time and effort attackers devote to operations impersonating behemoth financial institutions.

After discovering the threat actor's infrastructure, our team contacted Credit Agirole and the French CERT to inform the company and relevant authorities of the abuse. We have reached out for a statement and will update this article once we receive a reply.

How did the Credit Agricole phishing scam work?

The attackers are obviously not new to the cybercrime game. For example, they were acutely aware that sending phishing emails from suspicious servers would get them blocked. To bypass built-in restrictions, they opted to get access to legitimate businesses.

According to the team, cybercrooks started by scanning for unprotected Amazon Cloud buckets, specifically looking for environment files, database backups, Python configuration files, and even Vim swap files that contained SendGrid and AWS SES keys.

Legitimate businesses use SendGrid and Amazon SES to deliver high-volume emails, such as invoices, password reset emails, marketing messages, and notifications. To put it simply, it’s one of those “[email protected]” emails most of us have received numerous times from service providers we trust.

That’s why SendGrid and AWS SES keys in the wrong hands can be repurposed to distribute phishing messages through trusted infrastructure, making fraudulent emails harder to block and easier to believe.

However, the attackers did not stop here. According to our researchers, once the scammers got their hands on mail distribution platforms, they didn’t start to flood everyone with spam.

First, attackers used the stolen credentials to assess the rate limits and subscription tiers associated with the compromised accounts, effectively determining which hijacked services could send the most phishing messages.

“At the time of the investigation, the campaign had access to 149 stolen SendGrid API keys and three stolen AWS accounts, with a combined sending capacity of around a whopping 7,000 emails per day,” the team explained.

Meticulous about who to target

The Credit Agricole phishing scam also stands out for the way attackers built their target list. Instead of relying on a ready-made mailing database, threat actors appear to have carefully mapped organizations over several stages.

“They start with a seed list of 220k IP addresses known to host websites, and then they look for IP addresses in the same subnet to discover 250k new IPs,” our team explained.

The expanded address list was then linked to associated domain names via DNS lookups and SSL Certificate Transparency logs, and enriched with the world’s top 1 million domains.

To put it simply, attackers were building a bigger list of targets and deducing how they were related. That helps them in 2 ways: one is to get more potential victims, and the other is to identify whom to impersonate to convince those victims.

According to the team, the scammers didn’t stop there. They continued filtering the list, removing cloud hosting platforms, corporate static IPs, and generic virtual private servers (VPSs). That way, they likely tried to get rid of honeypots set up by security companies.

Our researchers say the attackers then scanned targets for exposed configuration files while simultaneously sending phishing messages to employees, whose contact details were likely sourced through legitimate commercial business intelligence platforms.

The “dual-track” approach suggests that the companies themselves were not only pools of potential banking victims, but also possible sources of additional infrastructure and intelligence.

In other words, a targeted organization could help the attackers in two ways simultaneously. First, by supplying exposed technical secrets, and then by providing employees who could be lured to fake banking pages.

“At the time of the investigation, the phishing panel’s database contained 912 victims who had entered their credentials into phishing forms, as well as 83 payments made to the scammers,” the team explained.

The French-language phishing email, obtained by our team, appears to have prompted users to “renew the registration” of a trusted device or risk losing access to their accounts. While on its own, this type of email could be suspicious, the story’s different if the sender's email address appears to be from a completely legitimate business.

What makes the story even more interesting is that analysis of the infrastructure and tooling used for this operation revealed that attackers were patient enough not to exploit banking credentials too obviously.

“What we saw was that bank credentials were used only to obtain additional data on the victim, with the main way of making money being calling the victims and using social engineering techniques to trick people into paying for a fake service,” our team explained.

According to the team, an analysis of the phishing panel’s backend shows that it automatically used the stolen victim credentials to extract the following information from the victim account:

• Remaining balance
• Local branch name
• The bank advisor’s name

The team surmised that the information enabled them to identify valuable targets and to trick the victims into believing they were speaking with Credit Agricole employees.

Scammers competing against each other

Not only did the scheme take time and effort to set up, but the threat actors also appear to have encouraged one another using highly corporate tactics. One of them was a leaderboard.

“The phishing panel also contained a leaderboard for the phishing operators to compete against each other on who can earn the most from their victims,” our researchers explained.

At the time of the investigation, the team noted that the phishing panel was configured to support multiple phishing operators, with 7 accounts registered. Screenshots our team took of the panels’ dashboard indicate that the prize for the most successful scammer was €3,000.

What makes the discovery interesting is the industrial scale behind it. The attackers appear to have combined scanning for exposed secrets, theft of legitimate email delivery tools, internet mapping, employee targeting, and phishing monetization into a single system.

For victims, the risks are obvious. Individuals who entered their credentials may face account takeover, fraudulent transactions, or social engineering attacks. At the same time, businesses whose email or cloud credentials were abused may suffer reputational damage, service disruption, and renewed exposure if more secrets remain publicly accessible.

The findings also underline a painfully obvious security problem: organizations continue to leave sensitive files exposed in internet-facing systems, unintentionally handing attackers the tools needed to operate fraud campaigns.