Ransomware · 74 days ago
A trusted cloud link and a password in the same email make the payload look like a secure file handoff, which is exactly why this campaign can slip past the normal attachment mindset. The fake Interpol message pushes the user to open a password-protected Proton Drive file, then hands off a disguised executable for the last step.
Bitdefender says the phishing campaign is targeting small businesses across Europe, Asia, the Middle East, and North America, with cases seen in food and agriculture, legal services, pharmaceuticals, media, technology, and finance. The lure claims to come from Interpol’s “Cybercrime Investigation Unit” and tries to force an urgent response around supposed suspicious activity.
The broader risk is that reputation checks alone do not cover a malicious download delivered through a real hosted service. Any email stack that treats cloud storage and password-protected links as safer than attachments inherits the same blind spot.
2 sources covering this story
Ransomware Thugs Masquerade as Interpol to Entice Small Biz
The ransomware campaign relies on basic social engineering and stretches across multiple regions, including the US, Europe, Middle East, and elsewhere.
Criminals Pose as Interpol in Phishing Emails to Deliver Ransomware
Bitdefender researchers warned of curious ransomware campaign which has targeted businesses around the world
Part of the PlainSec briefing for 2026-07-03