Operation SouthNet, attributed to the SideWinder threat actor, has seen an extensive escalation of phishing and malware activities throughout South Asia. Analysis revealed over 50 malicious domains used for hosting fake Outlook and Zimbra portals aimed at credential harvesting. The campaign has been diversified across five countries, with Pakistan comprising approximately 40% of the identified domains. Techniques employed include the distribution of weaponized documents themed around governmental affairs, underscoring the targeting of sensitive sectors. The operation was operational in August 2025, and it specifically aimed at government and defense organizations across Nepal, Bangladesh, and Turkey. SideWinder leveraged free hosting platforms such as Netlify and http://pages.dev to deploy its phishing infrastructure.