Phishing cases from this library, all 72 of them, from the one email behind the Anthem breach to fake-CEO requests that moved millions. For each one: the lure, what it cost, and what would have stopped it.
Phishing is a message pretending to be from someone you trust, sent to get you to hand over a password, open a file or move money. It usually arrives as an email, but the same trick turns up by text, chat and even fake job offers. It's still the most common way real breaches start.
Key takeaways
A fake login page collects your username and password, sometimes your MFA code too. More on credential harvesting.
One carefully researched message aimed at one person. See spear phishing.
No link at all. Just a convincing email from a "CEO" or "supplier" asking for a wire. See business email compromise, CEO fraud and invoice fraud.
The same idea by text (smishing), phone (vishing) or QR code (quishing).
| Case | The lure | What it led to |
|---|---|---|
| Anthem, 2015 | One email opened by a subsidiary employee | Personal data on 78.8 million people stolen |
| Target, 2013 | A malware-laced email at a small HVAC contractor | Vendor logins reused to get into Target's network |
| RSA, 2011 | An Excel file called "2011 Recruitment Plan" | A breach at the security company itself |
| Sony Pictures, 2014 | Fake Apple ID "verify your account" emails | Reused passwords harvested before the destructive attack |
| Clinton campaign and DNC, 2016 | Fake Google security alerts with shortened links | More than 300 people targeted by Russian GRU officers |
| 0ktapus, 2022 | Texts leading to fake Okta login pages | About 9,931 credentials harvested across 136 organisations |
| Axie Infinity, 2022 | A fake LinkedIn job offer with a spyware PDF | The Ronin bridge heist |
| Crelan, 2016 | Emails from a fake CEO | Close to EUR 70 million lost |
| Orion, 2024 | A criminal scheme aimed at one employee | Wires totalling roughly $60 million |
| Main Line Health, 2016 | A spoofed executive asking for W-2s | Tax data for about 11,000 staff sent to the attacker |
In February 2014, an employee at an Anthem subsidiary opened a phishing email. That one click gave a nation-state group a foothold, and over the following months they quietly took personal data on 78.8 million people. Nobody needed a zero-day to get in. Full case: Anthem breach.
Belgian bank Crelan lost close to EUR 70 million after staff acted on instructions from someone posing as its CEO. The same year, Austrian aerospace firm FACC wired about EUR 50 million for a fake acquisition, and EUR 41.9 million of it was gone for good. Neither attack used malware. Just email and authority. Full cases: Crelan, FACC.
RSA sells security products. Okta customers in the 0ktapus campaign had MFA. Both still got phished, because the attacker went for a person, not the system. A code you can type into a fake page can be stolen like a password.
Tip: if an email asks you to log in, don't use its link. Open the site the way you normally would. If it's real, the same alert will be waiting there.
Comparisons: spear phishing vs phishing, vishing vs phishing.
A message that pretends to come from someone you trust so you'll hand over a password, open malware or send money. Email is the most common channel, but texts, calls and QR codes are used too.
By people affected, Anthem in this library: 78.8 million records after one email. By money, fake-CEO cases like Crelan, at close to EUR 70 million.
Some kinds. Codes and push prompts can be phished, as 0ktapus showed. Security keys and passkeys are much harder to steal because they only work on the real site.
Tell IT straight away. If you entered a password, change it from a device you trust and sign out other sessions. If money was sent, call your bank immediately.
Reviewed by the SEE Team on 23 October 2026; every case linked here has its sources on its own page.
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC won a $5.5M default judgment.
PHIn 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How it happened, the tells, and what was recovered.
PHTarget's 2013 breach began with malware emailed to a small HVAC contractor. 40M cards and 70M records exposed. What's known, what's myth, and what it cost.
PHTexts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025. How the scam works and how to check a toll text.
PHA 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above $25M. Nine now convicted.
PHNorth Korea-linked attackers phished Sony staff with fake Apple ID emails, stole data and wiped thousands of PCs in 2014. How it worked and what it cost.
PHA '2011 Recruitment Plan' email with a booby-trapped Excel file breached RSA in 2011. SecurID data was stolen and later used against Lockheed Martin, RSA said.
PHAPT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government PCs. How it worked and how to catch it.
PHA compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's account, who later admitted wire fraud.
PHA fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the rest: 27 crypto accounts hijacked. What happened.
PHEvaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam worked and what came back.
PHImpersonators posing as two Philadelphia school vendors asked to switch from cheque to ACH and diverted nearly $700,000 in 2024. Found a year later by auditors.
PHScammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M recovered. How the thread hijack worked.
PHOrion S.A. lost about $60M in 2024 when an employee was tricked into wiring money to criminals. What Orion confirmed, what came back, and how to stop it.
PHAn attacker sent a LastPass employee WhatsApp calls and a voicemail using an AI copy of the CEO's voice. The employee reported it. What gave it away.
PHA 2025 campaign faked Portugal's tax authority and asked victims to paste a command to 'enable file preview', starting a chain to the Lampion banking trojan.
PHA fake email posing as DTC gave JE Cleantech false wire instructions for its 2026 dividend, diverting US$794,934 and delaying shareholder payments.
PHThe FTC warned in 2023 about fake QR codes on parking meters and in texts. What it said, the Texas meter stickers behind it, and how to check a code safely.
PHThe FBI's December 2024 warning on AI-enabled fraud: AI text, fake IDs, cloned voices and deepfake video, and what the FBI says to do about each.
PHIn 2025 the FBI, FTC and USPIS warned of unordered packages with QR codes that lead to phishing sites or malware. How the brushing 2.0 scam works.
PHCriminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How vendor email fraud works.
PHIn June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX flagged accounts. What the numbers mean.
PHIn 2025 the US sanctioned North Korean fronts that place fake IT workers abroad, and a US laptop farm operator got 102 months. How the scheme works.
PHNorth Korea-linked hackers ran fake job interviews for crypto firms, then told applicants to paste a 'camera fix' that installed malware. How ClickFake works.
PHLazarus hackers used a fake LinkedIn job offer to plant spyware on a Sky Mavis engineer's laptop, then drained $540M from the Ronin bridge in March 2022.
PHAttackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A reviewer cleared it. How it worked.
PHIn 2022, 0ktapus texted staff fake IT alerts linking to Okta lookalikes, stealing 9,931 logins and MFA codes. Twilio was breached; Cloudflare's keys held.
PHIn July 2020, callers posing as Twitter IT stole staff logins and hit 130 accounts, from Obama to Musk, with a bitcoin scam. How it worked and how it ended.
PH
Social Engineering Examples