Fake Boots emails target millions in large phishing campaign

As reported by Tech Radar, millions of UK shoppers were targeted by a massive phishing campaign that used fake emails appearing to be from health and beauty retailer Boots, offering a free beauty sample pack. The operation aimed to collect personal details through a fake customer survey and a fraudulent checkout process.

The campaign, involving nearly 8.9 million email addresses and linked to Romanian threat actors, utilized a compromised Bolivian government website to host the fraudulent Boots checkout page. Attackers leveraged a legitimate bulk mailing application, Gammadyne Mailer, installed on a compromised UK business terminal server to distribute the phishing emails. This allowed them to send messages directly from the organization's internet connection, masking their own infrastructure. The compromised server was not used for ransomware or data theft against the business but solely as a platform for sending fraudulent messages.

The same phishing toolkit has been observed across multiple compromised systems since July 2025, suggesting a broader, ongoing operation that also includes tax-related and cryptocurrency scams targeting UK consumers.

Source: Tech Radar