Targeted Campaign Against KPMG South Korea

This brief documents a sophisticated, active phishing campaign targeting KPMG South Korea employees using cleanupsystems.shop (registered Oct 14, 2025) to harvest corporate credentials and comprehensive PII—including home addresses—via a multi-stage, domain-validated registration and verification flow; infrastructure details (IP 180.230.8.65, MX/SPF on Cafe24) and a persistent 0/95 VirusTotal detection gap are highlighted as key risks.