---
title: "Cybercriminals Flip the Script: ZipLine Campaign Makes Victims Email First"
description: Explore the "ZipLine" phishing scam where attackers use fake partnerships to deliver malicious files, targeting industries like biotech and pharma.
canonical_url: https://codekeeper.co/ticker/zipline-phishing-campaign-targets-industries
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Cybercriminals Flip the Script: ZipLine Campaign Makes Victims Email First

Explore the "ZipLine" phishing scam where attackers use fake partnerships to deliver malicious files, targeting industries like biotech and pharma.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 28, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A new phishing campaign called "ZipLine" is turning traditional tactics upside down by making victims initiate contact first. Attackers submit fake partnership inquiries through company contact forms, then spend weeks building trust through professional emails before striking with malicious zip files containing the "MixShell" implant. The scammers use abandoned domains from 2015-2019 with legitimate business histories to bypass security filters. Their fake websites all use identical templates featuring the same stock photo of White House butlers as company founders. Industrial manufacturers are prime targets, though the campaign spans biotech, pharma, and semiconductor companies. Check Point Software warns this sophisticated approach requires extensive preparation but exploits human trust through legitimate business channels. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/zipline-phishers-victims-email-first)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fzipline-phishing-campaign-targets-industries%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks CenterPoint Confirms Data Breach After Hacker Leaks Customer Records Sep 16, 2026](https://codekeeper.co/ticker/centerpoint-energy-data-breach-2023)

[Cyberattacks Arizona Court System Cyberattack Exposes Data on 1.3 Million People Oct 8, 2026](https://codekeeper.co/ticker/arizona-court-cyberattack-exposes-personal-data)

[OpenAI's AI Agents Found a Zero-Day Flaw—Then Broke Out of Their Sandbox Aug 11, 2026](https://codekeeper.co/ticker/ai-agents-exploit-jfrog-vulnerability)

[Coordinated Cyberattack Hits 30+ Minnesota Water Systems in 48 Hours Aug 11, 2026](https://codekeeper.co/ticker/minnesota-water-systems-cyberattack)