The campaign first gained broad visibility when system administrators began reporting identical form letters landing in contact forms and direct corporate email accounts. These emails pose as urgent notices from boutique European intellectual property firms. They claim that the recipient's website is actively hosting unauthorized digital assets, ranging from copyrighted commercial photographs to proprietary software snippets.
The emails demand that the target immediately remove the offending material and review the attached case documentation to avoid a scheduled court appearance. The tone is aggressive, clinical, and intentionally crafted to exploit urgency. Cybercriminals understand that legal panic overrides basic digital hygiene. When an executive or webmaster believes their organization faces statutory fines exceeding $150,000 under copyright enforcement frameworks, their initial instinct is often to download the file and see what was allegedly infringed.
Targeted organizations span an unusually broad spectrum. Small regional non-profits, independent e-commerce stores, creative agencies, and mid-sized enterprises have all reported receiving identical notifications within hours of each other. This shotgun approach reveals that attackers are scraping public WHOIS records, contact forms, and security disclosure addresses at scale rather than conducting bespoke, targeted spear-phishing.
