Executive Summary
A high-severity phishing campaign has been identified impersonating Interactive Brokers to target US healthcare providers. The attackers leverage a regulatory compliance pretext, claiming the recipient's W-8BEN tax form has expired and threatening increased tax withholding to pressure victims into clicking a malicious link.
The technical tradecraft involves the use of '0-day' domains registered the same morning as the campaign delivery. These domains are placed behind Cloudflare challenge pages (bot-checks) to prevent automated security scanners from inspecting the final credential-harvesting payload. By returning an 'unknown' or 'clean' status from scanners that cannot bypass the challenge, the attackers successfully bypass traditional reputation-based and sandbox defenses.
This campaign highlights a significant gap in Link Protection services. In observed cases, organizational link-wrappers marked the malicious URL as clean simply because the proxy successfully reached the destination, despite the destination being a brand-new domain with no reputation history.