A phishing campaign is actively targeting healthcare, government, hospitality, and education organizations across multiple countries, using fabricated copyright infringement notices to trick employees into downloading infostealer malware. If successful, the malware harvests credentials, browser session data, and stored passwords, creating direct exposure to account takeover, data breach, and regulatory liability. This is a social engineering attack with no technical patch; awareness and email controls are primary defensive layers.