A Russian-linked phishing-as-a-service group ran a months-long phishing campaign targeting freight and logistics companies across the U.S. and Europe, stealing more than 1,600 login credentials.
The group dubbed “Diesel Vortex” — operated from at least September 2025 through February, focusing on platforms widely used by brokers, carriers and supply chain operators, according to a joint investigation released on Tuesday by cybersecurity researchers Have I Been Squatted and Ctrl-Alt-Intel.
The investigation found 1,649 unique credentials were compromised, drawn from 3,474 stolen login pairs. Impacted parties included users of DAT Truckstop, Penske Logistics, Electronic Funds Source (EFS), Timocom and other freight-focused systems, according to the report.
Researchers described Diesel Vortex as a structured phishing-as-a-service operation, not a lone hacker. The group built dedicated phishing infrastructure for logistics load boards, fleet portals and fuel card systems, using targeted email and voice phishing to capture credentials and multi-factor authentication codes in real time.
A key breakthrough in the investigation came after analysts discovered an exposed .git directory on a phishing domain, enabling them to reconstruct the group’s codebase and review a 36.6MB SQL database dump dated Feb. 4, Have I Been Squatted and Ctrl-Alt-Intel said in the report.
That database showed 52 phishing domains deployed, more than 75,000 targeted contact emails and 35 confirmed EFS check fraud attempts.
Diesel Vortex also used a dual-domain architecture designed to evade detection, with one “advertise” domain visible to victims and a hidden “system” domain loading phishing content inside an iframe, an element that loads another HTML element inside of a web page, such as external ads, videos or tags.
Operators controlled victim sessions through a Telegram-based console, steering targets through credential capture flows and secondary email phishing modules in real time.
According to the report, the platform was internally branded “GlobalProfit” and appeared to be under active development as a broader phishing-as-a-service product, potentially marketed to other operators.
Have I Been Squatted and Ctrl-Alt-Intel said they coordinated with multiple industry partners during the investigation and worked to notify affected parties.
Brokerage Compliance Symposium
The day before F3. Every compliance issue you face - fraud exposure, carrier liability, FMCSA rules, cargo theft, insurance gaps - navigated by attorneys and operators defining best practices in a changing industry.
F3 Awards Dinner
The night before F3. FreightTech100 companies honored. FreightTech 25 and Shipper of Choice winners revealed live. Cocktail reception into dinner and live music - 300 industry leaders in one purpose-built room.
F3: Future of Freight Festival
Industry-defining keynotes, rapid-fire technology demos, and industry leaders networking in experiences across Chattanooga - plus the inaugural F3 Awards Dinner featuring the FreightTech and Shipper of Choice reveals.
The day before F3. Every compliance issue you face - fraud exposure, carrier liability, FMCSA rules, cargo theft, insurance gaps - navigated by attorneys and operators defining best practices in a changing industry.
The Signal at Chattanooga Choo Choo • Chattanooga, TN Register NowThe night before F3. FreightTech100 companies honored. FreightTech 25 and Shipper of Choice winners revealed live. Cocktail reception into dinner and live music - 300 industry leaders in one purpose-built room.
The Signal at Chattanooga Choo Choo • Chattanooga, TN Register NowIndustry-defining keynotes, rapid-fire technology demos, and industry leaders networking in experiences across Chattanooga - plus the inaugural F3 Awards Dinner featuring the FreightTech and Shipper of Choice reveals.
The Signal at Chattanooga Choo Choo • Chattanooga, TN Register Now