Loading story…
CERT-AGID warned of new smishing campaigns impersonating Italy’s INPS, using the agency’s name, logo, and branding to lure victims to fraudulent websites that harvest personal information and payment card data. Investigators observed at least two visual variants of the fake pages and different requested payment amounts, indicating the operators may be testing which lure performs better while maintaining the same core objective of credential and financial theft.
Separate infrastructure analysis tied the INPS-themed activity to a broader phishing operation built on newly registered lookalike domains such as inps names on low-cost TLDs including .cfd, .sbs, .bond, and .buzz. Pivoting from four Tencent-hosted IP addresses and shared traits such as cloned login portals, root-path 404 behavior, and GoFrame HTTP Server fingerprints expanded the cluster from 19 recent INPS-themed domains to 148 domains associated with 196 scans and impersonation of 25 brands across roughly a dozen countries, suggesting an organized actor reusing the same playbook beyond the Italian government theme.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
CERT-AGID identified new smishing campaigns impersonating INPS through use of its name, logo, and branding to steal personal information and payment card data via malicious websites. The fraudulent sites appeared in two graphic variants and requested different payment amounts, suggesting possible A/B testing by the operators.
Because many of the domains had previously gone unflagged or unscanned, the researchers submitted all 148 domains to urlscan with phishing-related tags to improve visibility and detection.
By pivoting on four Tencent IP addresses, researchers expanded the cluster from 19 recent INPS-themed domains to 148 unique domains tied to 196 scans and impersonation of 25 brands across about a dozen countries. Links involving trenitalia.id and trenitalla.id suggested overlap with a previously documented campaign and likely reuse of the same actor playbook.
An investigation starting from newly registered domains resembling Italy's INPS brand found cloned login portals, root-path 404 behavior, GoFrame HTTP Server fingerprints, and hosting on Tencent AS132203, indicating an organized phishing operation rather than isolated registrations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecarlesi.vg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026
Group-IB reported that the **Smishing Error524** operation has run since the second half of 2025, expanding from Latin America to **72 countries** while impersonating more than **267 brands** across telecommunications, financial services, consumer rewards, government, and logistics. Investigators linked the campaign to at least **4,389 phishing domains**, with **Mexico** the most heavily targeted country, followed by **Chile** and **Colombia**. The attack begins with SMS lures sent from local-looking numbers and shortened links, directing victims to phishing pages designed to harvest national identification numbers, personal details, and full payment card information. The infrastructure uses a layered anti-analysis design that shows fake **Cloudflare Error 524** pages to researchers, scanners, and other non-targeted visitors, while only users matching geofencing, mobile device, and session checks receive the malicious content. Group-IB said the phishing kit is an obfuscated **Vue.js** single-page application using Base64-encoded content and FormKit, with stolen data exfiltrated in real time over encrypted WebSocket channels and heartbeat telemetry. Operators also hid backend systems behind **Cloudflare** proxies and used origin hosting tied to **Tencent Cloud** and **Alibaba Cloud**, helping mask infrastructure and rotate domains quickly.
Jun 29, 2026
**INTERPOL** said **Operation Synergia III** led to the arrest of **94 suspects**, the seizure of **212 devices and servers**, and the sinkholing or takedown of more than **45,000 malicious IP addresses** tied to cybercrime infrastructure across **72 countries and territories**. The operation ran from July 2025 through January 2026 and targeted infrastructure supporting **phishing, malware, ransomware, romance scams, credit card fraud, and related online fraud**. Authorities said **110 additional individuals remain under investigation**, underscoring that follow-on enforcement activity is still ongoing. Preliminary case details show broad international participation and a focus on both technical infrastructure and fraud operators. In **Macau**, investigators identified more than **33,000 phishing and fraudulent websites**, including fake casino, banking, government, payment, and other critical-service sites used to steal credentials and payment data. In **Bangladesh**, authorities arrested **40 suspects** and seized **134 devices** linked to loan scams, employment scams, identity theft, and credit card fraud, while in **Togo** police arrested **10 suspects** tied to a fraud ring whose members split responsibilities between account compromise and social-engineering schemes such as romance and sextortion scams. The reporting describes a coordinated law-enforcement disruption of active criminal infrastructure rather than a vendor announcement or generic security guidance.
Jun 29, 2026