---
id: 6223
title: "APT MuddyWater Targets CFOs with Multi-Stage Phishing & NetBird Abuse"
source_domain: hunt.io
source_url: "https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos"
published_at: "2025-08-20T00:00:00Z"
tags: ["phishing", "social-engineering", "apt", "persistence", "muddywater", "netbird"]
phying_url: "https://phying.com/item/6223"
lang: en
---

# APT MuddyWater Targets CFOs with Multi-Stage Phishing & NetBird Abuse

## Summary

Spear-phishing impersonating a Rothschild & Co recruiter targets CFOs worldwide with Firebase-hosted phishing pages, VBS downloaders, and NetBird for persistent access; overlaps with MuddyWater.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-08-20T00:00:00Z
- **Original:** https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos
- **Phying News:** https://phying.com/item/6223