Financial Services Under Siege as Multi-Channel Social Engineering Campaigns Surge, Doppel Finds

A new threat intelligence report signals a sharp evolution in how cybercriminals are targeting financial services and fintech companies, shifting from isolated phishing attempts to coordinated, high-scale social engineering operations that span advertising platforms, messaging apps, and email.

According to Doppel’s latest research, attacker activity targeting the sector accelerated dramatically in early 2026, with March showing nearly a fourfold increase compared to January levels. This spike reflects more than just volume. It highlights a fundamental change in attacker strategy, one that prioritizes reach, automation, and conversion efficiency over traditional infrastructure-heavy phishing campaigns.

From Phishing to Full-Funnel Attack Campaigns

The report describes a modern attack lifecycle that mirrors legitimate digital marketing funnels. Threat actors are no longer relying solely on malicious domains to lure victims. Instead, they are building layered engagement paths that begin with exposure through ads or social media, move into interaction via messaging platforms, and end with credential theft or fraud on spoofed websites.

This shift has redefined where the real risk lies.

While malicious domains remain part of the equation, they are increasingly used as the final step rather than the primary entry point. Attackers are investing more heavily in earlier stages of the attack chain, where they can scale visibility and manipulate user trust at a much larger volume.

Paid Ads and Social Platforms Become Primary Attack Vectors

One of the most notable findings is the growing dominance of paid distribution channels. By March, platforms such as Facebook Ads and Facebook emerged as leading sources of malicious activity, alongside TikTok and Instagram.

This marks a clear pivot from earlier months, where attack traffic was more evenly distributed across channels like Telegram, Twitter, and hosting platforms.

The implications are significant for enterprise security teams. Paid advertisements allow attackers to bypass traditional discovery barriers and place fraudulent content directly in front of targeted users. These campaigns often mimic legitimate financial services, leveraging urgency and trust to drive engagement.

By April, email re-emerged as a leading channel, reinforcing the shift toward fully integrated, multi-channel campaigns that combine paid, organic, and direct communication methods.

Financial Sector Outpaces Broader Threat Landscape

The data shows that financial services were not always the primary focus. During the winter months, activity in the sector lagged behind the broader market. That changed abruptly in March, when financial services attacks surged to more than double the overall market baseline.

Early April trends suggest the gap is widening further, with activity tracking at nearly three times the broader market level.

While tax season plays a role in driving this surge, the report makes clear that the underlying trend is structural rather than seasonal. Attackers are refining repeatable, scalable models that can be redeployed across campaigns and industries.

Impersonation, Ads, and Multi-Step Deception Define Modern Threats

Doppel identifies three dominant threat themes shaping the current landscape:

• Impersonation and brand abuse: Fake financial platforms and support accounts designed to harvest credentials and funds

• Ad-driven scam campaigns: Paid promotions used to scale fraudulent offers and impersonation attempts

• Multi-channel social engineering: Coordinated campaigns that move victims across platforms to increase success rates

These campaigns are increasingly resilient. Infrastructure can be rapidly rebuilt using modern hosting platforms, allowing attackers to maintain momentum even after partial takedowns.

The Rise of Scalable Social Engineering

Another emerging trend is the expansion of direct engagement tactics, including voice-based scams and real-time interaction methods. These approaches signal growing attacker confidence and a willingness to engage victims beyond passive phishing.

The broader takeaway is clear. Cybercriminals are adopting playbooks that resemble growth marketing strategies, optimizing for reach, engagement, and conversion.

Why Traditional Defenses Are Falling Behind

The report warns that security strategies focused solely on indicators like malicious domains are no longer sufficient. By the time a phishing site is identified and taken down, victims may have already been funneled through multiple touchpoints.

Effective defense now requires visibility across the entire attack chain, including:

• Social media platforms

• Advertising ecosystems

• Messaging applications

• Email infrastructure

Without this holistic view, organizations risk disrupting only fragments of a much larger campaign.

A Permanent Shift in Cyber Threat Strategy

The transformation outlined in the report is not a temporary spike. It represents a more mature and efficient attack model that is likely to persist.

Financial institutions face a new reality where attackers operate with the speed and precision of digital marketing teams, using automation and cross-channel coordination to scale fraud operations globally.

For defenders, the challenge is no longer just detecting threats. It is understanding how those threats are orchestrated across platforms and stopping them before they reach the point of conversion.

As multi-channel social engineering becomes the dominant attack model, the organizations that adapt fastest will be the ones that stay ahead.