Operation Digital Eye uses targeted phishing, malicious documents, and post-compromise surveillance to collect information from selected organisations. Teams should watch for lure emails, document-triggered code execution, credential harvesting, and unusual data exfiltration. Limiting document abuse, protecting credentials, and correlating endpoint alerts with network flows improves visibility.
How Operation Digital Eye’s attack chain works
The tactics are a classic intrusion-to-surveillance sequence: lure the target, get code to run, harvest credentials, then quietly observe and exfiltrate information. The malicious document is not the end goal, it is the bridge from initial delivery to post-compromise access and collection. That means defenders need to think about both the phishing entry point and the later-stage activity it enables.
Targeted phishing matters here because it is designed for a narrow audience, so generic spam controls are rarely enough on their own. Well-crafted lures often blend into routine business traffic, which is why email security, user reporting, and link and attachment inspection all matter. The first success condition is usually not “the email looked malicious,” but “the attachment or link created a path to code execution or credential theft.”
Malicious documents are especially useful to attackers when they can trigger macros, exploit a parser weakness, or push the user into enabling content. Once that happens, the document becomes a delivery mechanism for the next stage of compromise rather than just a file. The practical question for defenders is whether office file handling is allowed to create execution paths, network calls, or child processes that should never be normal for the business context. For background on how threat actors are grouped and tracked, see Threat Actor Groups Guide.
What post-compromise surveillance usually looks like
Once an intruder has access, surveillance is often more important than immediate disruption. The attacker may enumerate users, browse files, monitor mailboxes, or collect business data slowly enough to avoid obvious alerts. This stage is what turns a one-off phishing success into a durable intelligence operation, because the goal is not just entry, but sustained visibility into selected organisations.
Credential harvesting is one of the main enablers of that persistence. If a phished account can be reused, the attacker can return without repeating the initial lure. That is why credential theft, session theft, and reuse of stolen access material should be treated as part of the same campaign, not as separate events. The strongest defensive signal is often a combination of identity anomalies, unusual login paths, and later data movement rather than any single alert on its own.
Data exfiltration may be low and slow, or it may be disguised as normal cloud, mail, or web traffic. That is why endpoint visibility alone is not enough. Correlating endpoint telemetry with proxy, DNS, and network flow data helps reveal when a compromised host is both executing suspicious content and sending information outward. The key analytical shift is to look for sequence, not just isolated indicators. For more technique-level mapping of common phishing methods, see Top 10 Phishing Techniques.
How to defend against the campaign pattern
Defence should be layered around the attacker’s sequence. Harden document handling, restrict macro and script abuse, enforce stronger email filtering, and reduce the value of stolen credentials through phishing-resistant authentication where possible. On the detection side, tune alerts for document-triggered processes, suspicious child process chains, and outbound connections that follow attachment execution.
Response should start with exposure validation: identify who received the lure, whether the document executed anything, and whether any credentials or sessions were captured. If compromise is possible, reset access material before spending too long on benign-versus-malicious debate. In campaigns like this, speed matters because the same access used for surveillance is often reused for lateral collection or deeper persistence.
Practitioner takeaway: Treat the phishing email as the opening move, not the whole incident, and verify whether the document created executable access, stolen credentials, or a live surveillance foothold before closing the case.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Maps the lure-email entry path used in this campaign. |
| T1059 — Command and Scripting Interpreter | Covers malicious-document execution paths that launch code after user interaction. | |
| T1027 — Obfuscated Files or Information | Relevant when malicious documents hide payloads or evade inspection. | |
| Recommendation — Map the lure to T1566 and tune detections for attachment- and link-based delivery. Hunt for T1059-style execution chains after document open events. Inspect suspicious documents for obfuscation and file-carried payloads. | ||