Cybersecurity Alert – Ongoing Phishing Campaign Impersonating FINRA Executives

IMPACT: All Firms

FINRA member firms should be aware of an ongoing phishing campaign involving threat actors targeting executive employees at broker-dealers and investment advisors with fraudulent emails purporting to be from FINRA executives. The campaign began on or around May 21, 2025. These emails are not from FINRA, and firms should delete them and consider blocking the indicators of compromise contained at the end of this alert.

Fraudulent Email Example

The primary domains used in this campaign include the following, the first of which may be visible in the from field or when hovering over the sender name:

• membership-finra[.]org
• memberships-finra[.]org

The following is an example of the text within the body of the phishing email:

Recommended Actions

• Immediately delete any emails from these domains or with similar content.
• Block these domains at your email gateway and firewall:
  • membership-finra[.]org
  • memberships-finra[.]org
• Alert your staff to watch for emails claiming to be from FINRA executives requesting firm information.
• Verify all FINRA communications through official channels (e.g., confirming delivery from a FINRA email domain or contacting your firm’s Risk Monitoring Analyst) before responding.
• Report any incidents where these emails may have been responded to or where information was provided to the sender.

Technical Details

The impersonated phishing emails allege that FINRA executives are attempting to collect and update firm information by completing a request template. However, the phishing emails FINRA analyzed did not include any attachments. FINRA staff believe that the threat actors included this language to elicit a response from recipients.

FINRA analyzed a sample of the phishing emails and identified that the threat actors used different domains in the "From" and "Reply-To" fields:

• From: membership-finra[.]org
• Reply-To: memberships-finra[.]org (may not be readily viewable unless examining full email headers)

Both domains utilize several mail servers at Google and Microsoft, as well as a misconfigured outlook domain for the spearphishing campaign. The email headers revealed the threat actor used an Amazon EC2 instance¹ to conduct the spearphishing campaign with Google's Gmail API² named 'gmailapi.google.com', likely to automate sending bulk emails.

A review of the sample emails supports the bulk email campaign theory, since all emails used the same text with different variables in the following fields:

• Recipient email address
• Recipient name
• Subject of emails
• From email address
• From name at the end of the email body
• From name in the email signature block

This behavior suggests the threat actors leveraged lists to programmatically rotate the variable fields.

The threat actor created a rudimentary decoy webpage for membership-finra[.]org that appeared to be in the initial stages of development. The site contained misconfigured and outdated Google Universal Analytics cookies or tags, deprecated by Google in 2024.³

The phishing emails and indicators of compromise are not connected to or endorsed by FINRA. Firms should delete all emails originating from these domains and consider blocking the indicators of compromise at the firewall.

Member firms should be aware that they may receive similar phishing emails from other domain names as the threat actors may rotate domains or associated infrastructure, in addition to those identified in this Alert.

FINRA reminds firms to verify the legitimacy of any suspicious email prior to responding to it, opening any attachments or clicking on any embedded links.

FINRA is working with the appropriate providers and have reported the event.

Indicators of Compromise

Indicators Observed On Shared Hosting, Observed 05/20/2025, Shared For Situational Awareness

For questions related to this Alert or other cybersecurity-related topics, contact the FINRA Cyber and Analytics Unit (CAU). In addition, the FBI and CISA urge you to promptly report phishing incidents to a local FBI Field Office, the FBI Internet Crime Complaint Center (IC3) at IC3.gov, or CISA via CISA’s 24/7 Operations Center ([email protected] or 888-282-0870).

Note: This Alert does not create new legal or regulatory requirements or new interpretations of existing requirements, nor does it relieve firms of any existing obligations under federal securities laws, regulations, and FINRA rules. Member firms may consider the information in this Alert in developing new, or modifying existing, policies and procedures that are reasonably designed to achieve compliance with relevant regulatory obligations based on the member firm’s size and business model. Moreover, some questions may not be relevant due to certain firms’ business models, sizes, or practices.