Loading story…
National cyber authorities in Croatia and Slovenia warned of an active SMS and iMessage phishing campaign that falsely tells recipients they owe traffic fines and must pay immediately through linked websites. In Croatia, CERT.hr said the messages direct users to fake pages mimicking the official ePrekršaji dispute-resolution portal, while police stressed that traffic fine notifications and payment requests are not sent by SMS. In Slovenia, SI-CERT reported that attackers impersonated the police and the Ministry of the Interior, claiming victims owed a €39 road-traffic penalty and pushing them to newly registered phishing domains.
The Slovenian campaign rapidly scaled, with roughly 100 different URLs observed across unique newly registered domains, and victims who entered payment-card details saw them abused almost immediately for high-value online purchases. SI-CERT said the operation later expanded to additional lures involving unpaid income-tax prepayments and undelivered packages, with matching indicators suggesting the same actors were behind all variants. Both agencies urged citizens not to click links, reply to the messages, or submit personal or financial information to the fraudulent sites.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
VJ CSIRT warned of a phishing and smishing campaign targeting Slovak citizens with SMS messages impersonating services under Slovakia’s Ministry of Interior and claiming a traffic fine must be paid. The fraudulent sites collected a vehicle registration number, displayed a fake speeding offense, and attempted to steal payment card data; the identified domains shared registrar and infrastructure characteristics suggesting a unified operation.
The phishing operation expanded beyond traffic fines to impersonate the Financial Administration of the Republic of Slovenia over unpaid income tax prepayment and a delivery service over an undelivered package. SI-CERT assessed from matching indicators of compromise that the same attackers were behind all variants.
By this date, the attackers had used about 100 different URLs in the Slovenian traffic-fine phishing campaign, with each URL hosted on a unique newly registered domain. Victims who submitted card details had them immediately abused for high-value online purchases.
A large-scale phishing campaign in Slovenia began using fake iMessage messages from foreign phone numbers that impersonated the police or Ministry of the Interior. The messages pushed recipients to pay a supposed €39 traffic fine through newly registered phishing domains that harvested payment card data.
Croatia's National CERT warned of an ongoing SMS phishing campaign that falsely claimed recipients had committed traffic violations and needed to pay fines. CERT said it had received multiple citizen reports and identified two fraudulent website variants mimicking the official ePrekršaji portal to steal personal and financial data.
VJ CSIRT warned of a phishing and smishing campaign in Slovakia that used stickers or flyers placed on parked vehicles, claiming a traffic offense and directing victims via QR codes to fraudulent sites. The campaign impersonated Slovak government services, prompted victims for personal data and SMS verification, and then demanded payment of a fake fine; CSIRT identified platbymvsr[.]sk, platby-mvsr[.]sk, and sk-slovensko[.]web[.]app as related sites.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcecert.si
Open sourcecert.hr
Open sourcecsirt.sk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A smishing campaign is sending fake traffic violation, toll evasion, and DMV-related text messages to drivers across multiple U.S. states and other countries, impersonating courts, motor vehicle agencies, and toll operators such as **E-ZPass**. The messages pressure recipients with claims of unpaid fines, license suspension, or arrest, often cite small balances such as **$6.99**, and direct targets to malicious links or QR codes designed to harvest personal and financial information. Reported activity spans New York, California, North Carolina, Illinois, Virginia, Texas, Connecticut, and New Jersey, with similar lures also observed in Canada and India. Researchers said the campaign increasingly uses embedded QR codes to bypass security filters, sometimes sending victims through a CAPTCHA-protected intermediary page before redirecting them to spoofed payment portals. Observed phishing infrastructure included domains such as `ny.gov-skd[.]org` and `ny.ofkhv[.]life`, while the texts often originated from random or international numbers. State agencies said they do not request payment or sensitive information by text message, and recipients are being urged not to click, scan, or reply, to verify any alleged violation through official websites or contact channels, and to report the scam to their mobile carrier, the **FTC**, and the **FBI IC3**; anyone who submitted payment data should contact their bank immediately and replace affected cards.
Jul 4, 2026
Multiple active fraud and malware operations are abusing *trusted themes and brands* to compromise users, with a heavy emphasis on mobile-first delivery via social engineering. Zimperium reported a **targeted Android spyware** operation delivered through a fake “dating” app promoted via social media and messaging links; once installed, the app requests broad permissions (e.g., SMS, contacts, media) to enable **surveillance and data exfiltration** including messages, location, and credentials. Separately, Zimperium also described an Android campaign that **hides a RAT inside artifacts presented as legitimate AI/ML components** hosted on trusted framework infrastructure, enabling attackers to bypass basic screening and gain persistent device control (data theft, screen capture, remote command execution). In parallel, CybersecurityNews summarized two public-service impersonation campaigns tied to “traffic ticket” lures. In India, attackers are mimicking **RTO e-challan** notifications distributed via WhatsApp and other messaging platforms to push off-store Android apps that steal financial and personal data; the malware reportedly uses a **three-stage modular architecture**, dynamic remote configuration, anti-analysis, and a **custom VPN tunnel** to conceal C2 and exfiltration, while prompting victims for high-risk permissions and to disable battery optimization for persistence. In Canada, a separate operation uses **SEO poisoning** and SMS/ad lures to drive victims to **fake provincial traffic ticket payment portals** (e.g., BC, Ontario, Quebec) that harvest PII and payment card data; Unit 42 attributed the activity to a broader fraud network using a phishing kit with a “waiting room” feature and infrastructure spanning **70+ domains**, including concentration on the `45.156.87.0/24` netblock.
Jun 29, 2026
Infoblox researchers reported a long-running **International Revenue Share Fraud (IRSF)** campaign that uses fake CAPTCHA pages to trick mobile users into sending premium-rate international text messages. Victims are funneled through typosquatted telecom-themed domains, ad-network redirects, and **Traffic Distribution System (TDS)** infrastructure to scam landing pages that present bogus verification steps. Those prompts trigger JavaScript that opens the phone’s SMS app with pre-filled messages and dozens of international numbers, and a single four-step interaction can generate about **60 SMS messages to more than 50 destinations**, costing roughly **$30 or more** per session. Researchers said the operation has been active since at least 2020, uses high-fee destinations including **Azerbaijan, Egypt, and Myanmar**, and has been linked to an affiliate of a European **Click2SMS** network using infrastructure hosted on **AS15699, Adam Ecotech**. Separately, Toronto police arrested three men in what authorities described as Canada’s first criminal case involving a mobile **SMS blaster**, a rogue device that impersonates a cellular tower to push phishing texts and disrupt legitimate service. Investigators said the devices were tracked across the Greater Toronto Area after one was detected in downtown Toronto, and police seized multiple SMS blasters and related equipment. Authorities believe **tens of thousands of phones** connected to the rogue system, contributing to more than **13 million network disruptions** that may have interfered with normal mobile access and even emergency services such as **911**. The cases highlight how attackers are abusing both web lures and fake base-station hardware to scale **smishing** and mobile billing fraud.
Jun 29, 2026