# Global phishing campaigns targeting subscription services

> Live situation record from CLSTR: https://clstr.news/situations/global-phishing-campaigns-targeting-subscription-services
> Updated: 2026-09-01T13:00:00.000Z. Sources: 2. Developments: 2.

Cybercriminals are increasingly utilizing phishing and smishing tactics to impersonate popular subscription-based digital services. Initially, reports highlighted widespread smishing campaigns in France, where fraudulent SMS messages claimed Netflix accounts were suspended or payments had failed to trick users into providing credentials and credit card details on mimic websites.

Subsequent data indicates this is a global trend. A Financial Threat Report by Kaspersky identified Netflix as the most impersonated brand worldwide, accounting for 28% of cases, followed by Apple, Spotify, and Amazon. While Netflix leads globally, Spotify is the most frequently spoofed brand in Latin America. The campaigns exploit user familiarity with these platforms to steal data and payment information, often using high-pressure tactics and mismatched URLs.

## Timeline

### 2026-09-01: Netflix and Spotify targeted in rising global phishing campaigns

Kaspersky reports that cybercriminals are increasingly impersonating subscription services like Netflix, Apple, and Spotify to conduct phishing attacks and steal financial data.

2 sources. https://clstr.news/cluster/netflix-and-spotify-targeted-in-rising-global-phishing-campaigns

### 2026-08-14: Netflix impersonation scams target users via SMS

Fraudsters are using smishing attacks, impersonating Netflix via SMS, to steal banking details and login credentials through fake websites.

2 sources. https://clstr.news/cluster/netflix-impersonation-scams-target-users-via-sms

---
Cite as: Global phishing campaigns targeting subscription services. CLSTR, https://clstr.news/situations/global-phishing-campaigns-targeting-subscription-services