Loading story…
A phishing campaign is targeting Free Mobile customers with convincing copies of the provider’s official email templates and website, demanding payment of a supposedly overdue €9.99 invoice to avoid service suspension. Malwarebytes reported the campaign against the backdrop of Free Mobile’s October 2024 customer-data breach. CNIL lists €42 million in combined fines against FREE MOBILE and FREE over the breach; Malwarebytes cites a €27 million fine for Free Mobile.
The fraudulent emails direct recipients through URL shorteners and attacker-controlled domains to pages requesting credit card details. Recent variants use authentic-looking domains hosted by Cloudflare, including espace-free-mobile.pro, freesas.info, and regularisation-free.info. The report does not establish that the attackers used information stolen in the breach. Customers should verify billing demands through Free Mobile’s official app or independently accessed website, while security teams should monitor for these domains and billing-themed impersonation.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A Malwarebytes employee received an email copying Free Mobile's branding and demanding payment of a €9.99 invoice to prevent service suspension. Its apparently legitimate link redirected through a URL shortener to espace-free-mobile.pro, where an authentic-looking payment form requested credit card details.
An unauthorized party accessed sensitive Free Mobile customer records, including bank account details and login information, in October 2024.
A phishing example identified as occurring in July routed recipients through a shortened URL to an attacker-controlled Free Mobile payment impersonation page. The source does not explicitly specify the year for this example.
CNIL imposed fines totaling €42 million on Free and Free Mobile over the data breach. Malwarebytes reports that Free Mobile's €27 million penalty was imposed in January for failures to protect customer data, without explicitly specifying the year.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France’s data protection regulator **CNIL** issued a collective **€42 million** fine against Iliad Group subsidiaries **Free** and **Free Mobile** for **GDPR** violations tied to an October 2024 breach that exposed personal data for more than **24 million** individuals, including sensitive financial identifiers such as **IBANs**. CNIL cited the scale and sensitivity of the compromised data, as well as the companies’ profits, in setting penalties of **€27 million** for Free and **€15 million** for Free Mobile. Regulators said the intrusion was enabled by inadequate security controls, including a **weak VPN authentication process** and insufficient monitoring to detect anomalous activity. Reporting indicates the attacker accessed Free’s network via the corporate **VPN**, then reached Free Mobile’s subscriber management tool **MOBO**, which at the time allowed searches across both Free and Free Mobile customer datasets; exfiltration reportedly began in early October 2024 after initial access in late September. CNIL also faulted the companies for **insufficient breach communications** to impacted customers and for **improper data retention** (including retaining former subscribers’ data), while noting remediation steps have been initiated and further security improvements were ordered.
Jun 29, 2026
Multiple **brand-impersonation phishing** campaigns are targeting consumers by abusing trust in *Avast* and *Apple* to drive victims into disclosing payment or account details. One campaign uses a near-identical fake *Avast* portal aimed at French-speaking users, presenting a fabricated **€499.99** “subscription charge” and a short cancellation window to induce urgency; the site validates entered card numbers using the **Luhn algorithm** and uses a **Tawk.to** live-chat widget (ID `689773de2f0f7c192611b3bf`) to pressure victims in real time into submitting full card details (including CVV) under the pretense of processing a refund. Separate *Apple*-themed scams use **phishing-to-phone** and **SMS** lures to route victims to scam call centers and harvest credentials and financial information. One email purporting to be from an “**Apple Fraud Prevention**” team attempts to panic recipients into calling a fake support number, while an “**Apple Security Alert**” Apple Pay text claims a suspicious **$143.95** Apple Store transaction and urges an immediate call to a `+1 850-85*` number to “cancel” the charge. Another tactic abuses iOS Calendar subscriptions (“**iPhone Calendar Scam**”) to flood devices with fake security/prize alerts that push users to click malicious links; guidance emphasizes unsubscribing from the rogue calendar and avoiding interacting with the spam invites.
Jul 1, 2026
National cyber authorities in Croatia and Slovenia warned of an active SMS and iMessage phishing campaign that falsely tells recipients they owe traffic fines and must pay immediately through linked websites. In Croatia, **CERT.hr** said the messages direct users to fake pages mimicking the official **ePrekršaji** dispute-resolution portal, while police stressed that traffic fine notifications and payment requests are **not** sent by SMS. In Slovenia, **SI-CERT** reported that attackers impersonated the police and the Ministry of the Interior, claiming victims owed a **€39** road-traffic penalty and pushing them to newly registered phishing domains. The Slovenian campaign rapidly scaled, with roughly **100** different URLs observed across unique newly registered domains, and victims who entered payment-card details saw them abused almost immediately for high-value online purchases. SI-CERT said the operation later expanded to additional lures involving unpaid income-tax prepayments and undelivered packages, with matching indicators suggesting the same actors were behind all variants. Both agencies urged citizens not to click links, reply to the messages, or submit personal or financial information to the fraudulent sites.
Jul 24, 2026