PHISHING INDEX

Below are the most common email phishing attempts detected by TG Soft's Anti-Malware Research Center in March 2024:

31/03/2024 => BRT
26/03/2024 => Meta
22/03/2024 => BRT
21/03/2024 => Aruba - Rinnova il dominio (Renew your domain)
13/03/2024 => Banco BPM
13/03/2024 => Istituto Bancario (Bank)
12/03/2024 => Mailbox Almost Full
11/03/2024 => Account di Posta (Email account)
06/03/2024 => Webmail
04/03/2024 => Aruba - Rinnova il dominio (Renew your domain)
01/03/2024 => LIDL


These emails are intended to trick some unfortunate person into providing sensitive data - such as bank account information, credit card codes or personal login credentials - with all the possible easily imaginable consequences.

• A little bit of attention and glance, can save a lot of hassles and headaches....

• Try Vir.IT eXplorer Lite

• Now Available VirIT Mobile Security

• Acknowledgements

• How to send suspicious emails for analysis

March 31, 2024 ==> Phishing BRT

SUBJECT: <Il tuo pacco non è stato consegnato.> (Your package has not been delivered)

We analyze below another phishing attempt hidden behind a false communication from the BRT courier company concerning the delivery of an alleged package.

HERE IS THE SURPRISE! After clicking on Continua (Continue), we are in fact redirected to a data-entry FORM that requires our credit card information to pay the shipping costs of the alerted package.

We observe that the page of the form is hosted on the following url address:<<https[:]//rcq[.]vvg[.]mybluehost[.]me/brt[.]it/myBRT/home/tarjeta[.]php>>which is completely unreliable and not related to BRT at all.
The purpose of the email is to induce the user to enter his/her personal data.

To conclude, we always urge you to be wary of any email that asks you to enter confidential data, and avoid clicking on suspicious links, which could lead to a counterfeit site difficult to distinguish from the original one. In fact in this way your most valuable data are put in the hands of cyber crooks and can be used for malicious purposes.

March 26, 2024 ==> Phishing META for Business

SUBJECT: <Your IP issue detected in your advertising>

We analyze below a new phishing attempt concealed behind a false communication from META, the company that manages the most popular social platforms.

When we enter our data and click Submit, we are prompted to enter our Facebook account password to confirm our identity.
Clearly, the well-known META company is unrelated to the mass sending of these emails, which are real scams whose goal remains, as always, to steal sensitive data of the unsuspecting recipient.

The purpose is to induce the user to enter the login password for his/her account, which will be stolen and used by cyber criminals.

March 22, 2024  ==> Phishing BRT

SUBJECT: <BRT - Giarcenza  580301>

We analyze below a new phishing attempt concealed behind a false communication from BRT, concerning the delivery of an alleged package.

HERE IS THE SURPRISE! After clicking Continua (Continue), we are in fact redirected to a data-entry FORM, that requires credit card information to pay the shipping costs of the package subject of the alert..

We see that the form page is hosted on the following url address:

<<https[:]//warehousing[.]shipping[.]20-215-193-139[.]cprapid[.]com/info/payment[.]php>> which is completely untrustworthy and is not related to BRT at all.

The purpose of the email is to induce the user to enter his/her personal data.
To conclude, we always urge you to be wary of any email that asks you to enter confidential data, and avoid clicking on suspicious links, which could lead to a counterfeit site difficult to distinguish from the original one. In fact in this way your most valuable data are put in the hands of cyber crooks and can be used for malicious purposes.

March 21, 2024 ==> Phishing Aruba - Rinnova il dominio (Renew your domain)

SUBJECT: <Rinnova il tuo dominio ****** in scadenza> (Renew your expiring ****** domain)

Phishing attempts, pretending to be communications from the Aruba brand, continue this month.

The message warns the recipient that his/her domain hosted on Aruba, linked to his/her e-mail account, will expire on 22/03/2024. It then asks him/her to manually renew it to avoid the deletion of the account and thus the deactivation of all services associated with it, including mailboxes, and the chance to receive and send messages.
It then invites the user to complete the renewal order by choosing the most convenient payment method, through the following link:
 
RINNOVA CON UN CLIC   (RENEW WITH A CLICK)

Clearly, the well-known web hosting, e-mail and domain registration services company Aruba, is unrelated to the mass sending of these e-mails, which are real scams whose goal remains, as always, to steal sensitive data of the unsuspecting recipient.

Analyzing the text of the message, we notice right away that the sender's e-mail address <communications-aruba(at)spiss[.]it> is not from Aruba's official domain.
In order to induce the victim to proceed with the renewal of his mailbox in a timely manner, the expiration date of 22/03/2024 is indicated. Since the mail was delivered on 21/03/2024,  there is not much time to carry out the renewal and prevent the deactivation of services.
The user is then offered to activate auto-renewal to get rid of deadlines and avoid thinking about service renewals. The procedure is simple and can be activated from the following link:

ATTIVA RINNOVO AUTOMATICO    (ACTIVATE AUTOMATIC RENEWAL)

Anyone who unluckily clicks on the link RINNOVA CON UN CLIC (RENEW WITH A CLICK), will be redirected to an anomalous WEB page, which has already been reported as a DECEPTIVE WEBSITE/PAGE. In fact it is run by cyber-criminals who want to get hold of your most valuable data, in order to use them for illegal purposes.

March 13, 2024 ==> Phishing Banco BPM

«SUBJECT: <seguire le istruzioni per evitare la sospensione dei suoi servizi online> (Follow the instructions to avoid suspension of your online services)

The following is another phishing campaign spreading through an e-mail exploiting stolen graphics or similar to the graphics of a well-known national banking institution (in this case Banco BPM). Hence it tries to pass itself off as an official communication, in order to induce the unsuspecting recipient to enter his/her data, and fall into a social engineering trap.

March 13, 2024 ==> Phishing Istituto Bancario (BANK)

SUBJECT: <Avviso! > (Warning!)

We find again this month the phishing campaign that spreads through an e-mail exploiting stolen graphics or similar to the graphics of a well-known national banking institution. Hence it tries to pass itself off as an official communication, in order to induce the unsuspecting recipient to enter his data, and fall into a social engineering trap.

March 12, 2024 ==> Phishing Mailbox Almost Full

SUBJECT: <RE: MAIL ALMOST FULL>

We analyze below another phishing attempt that aims to steal email account login credentials. 

The message, in English, informs the recipient that the space on his/her e-mail account is almost full and therefore invites him/her to free up space by deleting e-mails in order to receive new messages, via the link below:

CLEAR STORAGE

Analyzing the email, we notice that the message comes from an email address <account(dot)service(at)mailbox(dot)com> that could mislead the victim, as it is similar to Mailbox's domain, but it does not actually come from the official domain.

Anyone who unluckily clicks on the link CLEAR STORAGE will be redirected to an anomalous WEB page, which has already been reported as a DECEPTIVE WEBSITE/PAGE. In fact it is run by cyber-criminals who want to get hold of your most valuable data, in order to use them for illegal purposes..

March 11, 2024  ==> Phishing Account Posta Elettronica ((Phishing Email Account))

SUBJECT: <Verifica password> (Password verification)

We analyze below a new phishing attempt that aims to steal email account login credentials

The message, in English, informs the recipient that his/her e-mail account password will expire in 24 hours. It then invites him/her to confirm his/her password to continue using it, through the following link:

Conferma password   (Confirm Password)

Analyzing the e-mail we see that it seems to come from the recipient's address. This could mean that the mail account was actually compromised or that a label was used to simulate the victim's address.
Anyone who unluckily clicks on the Conferma password  (Confirm Password), link will be presented with the screen shown in the side image.
As we can see we are redirected to a site that is unrelated to the provider of the mail account. This is an anomalous address/domain, which we report below:

https[:]//www[.]24people[.]nl....

Given these considerations, we point out that you should NEVER enter your credentials on sites whose origin you do not know, as they will be sent to a remote server and used by cyber crooks with all the associated easily imaginable risks

March 06, 2024 ==> Phishing Webmail

SUBJECT: <Routine Mail Server Upgrade>

We analyze below the phishing attempt that aims to steal the victim's e-mail account credentials

The message, in English, informs the recipient that his/her email account is out of date and he/she can't send or receive messages. It then invites him/her to reconfirm the account to avoid delayed incoming messages, via the following link:

Confirm your Email

Analyzing the email, we notice that the message comes from an email address that could mislead the victim, as it appears to come from the recipient's domain <noreply(at)*****(dot)it>, but in fact the real sender has been disguised.

This is definitely anomalous and should, at the very least, make us suspicious

Anyone who unluckily clicks on the link Confirm your Email, will be redirected to an anomalous WEB page, which as you can see from the side image,is unrelated to the e-mail account manager.
The page where you are redirected, to enter your mail account credentials, is hosted on an anomalous address/domain, which we report below:

https[:]//cloudflare-ipfs[.]com/ipfs/bafybeieoxvl6l3tnajmoaofistnpm46pivaes....

We always urge you to be careful and not to enter your personal data and/or passwords on forms hosted on counterfeit web pages, as they will be sent to a remote server and used by cyber crooks with all the associated easily imaginable risks.

March 04, 2024 ==> Phishing Aruba - Rinnova il dominio (Renew your domain)

SUBJECT: <Rinnovo automatio del dominio xxxxx.it non riuscito> (Automatic renewal of domain xxxxx.it failed)

Phishing attempts, pretending to be communications from Aruba, continue this month.

The message informs the recipient that his/her domain hosted on Aruba linked to his/her e-mail account will expire on 05/03/2024. It then warns her/him that if the domain is not renewed, it will be deactivated along with all the services associated with it, including email accounts. He/she will therefore no longer be able to receive and send messages.
It then invites the user to log in to renew services, via the following link::

RINNOVA IL DOMINIO   (RENEW THE DOMAIN)

Clearly, the well-known web hosting, e-mail and domain registration services company Aruba, is unrelated to the mass sending of these e-mails, which are real scams whose goal remains, as always, to steal sensitive data of the unsuspecting recipient.

Analyzing the message, we notice right away that the sender's e-mail address<noreply(at)server110325[.]netart[.]com> is not from Aruba's official domain.
In order to induce the victim to promptly proceed with the renewal of his mailbox, an expiration date of 05/03/2024 is indicated. Since the mail was delivered on 04/03/2024, there is not much time available to carry out the renewal and prevent the deactivation of services. The technique of stating a deadline to conclude the procedure is intended to scare the user with the threat of deactivation of the mailbox, in order to push the him/her to act immediately and without much thought. 

Anyone who unluckily clicks on the link RINNOVA IL DOMINIO  (RENEW THE DOMAIN) will be redirected to the displayed page.

As we can see, first of all, the landing page, unlike what we expect, does not redirect to the access form to login to Aruba's RESERVED AREA but hosts an online payment form that seems to rely on the BancaSella circuit. Here you are directly prompted to enter your credit card information to complete the payment of the modest sum of Euro 5.99......

Although the user may be pushed to quickly complete the transaction by haste and the fear of email box suspension, if we just look at the url address shown on the broswer bar, we can realize that the payment form does not reside on the official domain of Aruba or even BancaSella:

https[:]//arubahost[.]assistenzastaff[.]net/0121/9.....

We therefore urge you not to rush and pay attention to every detail, even trivial ones.
By proceeding to enter the requested data, in this case your credit card details specifically, these will be delivered to the cyber criminals masterminding the scam who will use them for criminal purposes.

March 01, 2024==> Phishing LIDL

SUBJECT: <Festeggiamo l'anniversario di Lidl con un Samsung Galaxy S24 in omaggio > (Let's celebrate Lidl's anniversary with free Samsung Galaxy S24)

Below we analyze the scam attempt that hides behind a false communication from LIDL, the well-known supermarket.

This is a promotional message that seems to propose an unmissable opportunity. The lucky user was selected, on the anniversary of the supermarket chain, to participate in a survey and win a prize: a Samsung Galaxy S24...or at least that's what it seems.
Certainly for many inexperienced users this phishing is a real decoy.
Clearly, LIDL is unrelated to the mass mailing of these malicious campaigns, which are real scams whose goal remains, as always, to steal sensitive data of the unsuspecting recipient.
To avoid misunderstanding we underline that this is in fact a phishing attempt aimed at stealing your personal data.
So keep your eyes open ... all it takes to avoid unpleasant incidents is a little attention and a quick glance.


we are redirected to a ''landing'' page that, although graphically well done (with misleading images and the authentic LIDL logo ) does not seem trustworthy at all.
In fact, the survey to obtain the prize, is hosted on an anomalous address/domain.
Here is the web page:

"https[:]//xforegone[.]lat/855c92.....''

which has no connection with LIDL.
Cyber criminals masterminding the scam, try to induce the user to quickly finish the survey by making him/her believe that only few people can win and the gifts are about to run out. There is also a countdown timer at the bottom of the screen, which however, if stopped - as we simulated - will start over immediately. This is a rather strange thing.

Moreover, many comments from customers who supposedly participated in the survey, have been reported to give more credibility to the message. They are all reassuring testimonials/feedback about the actual delivery of the winnings that confirm the trustworthiness of the message, and some of them even include photos of the received prize.
Surely if so many users were lucky why not try your luck by filling out a simple survey?!

Clicking on   INIZIA IL SONDAGGIO (START THE SURVEY), you are redirected to the next screens, where you are asked to answer 8 questions.


''Congratulazioni! Abbiamo riservato (1) Samsung Galaxy S24 esclusivamente per te.''
(Congratulations!!! We have reserved (1) Samsung Galaxy S24 exclusively for you.')

Here we go: in fact, all you need to do is to enter your shipping address and pay the shipping cost, and in 5-7 business days the prize will be delivered....
Then you are redirected to a further page, to enter your shipping address and to pay the shipping charges, as shown in the image below.
The page where we are redirected, to enter our personal data, is hosted on a new anomalous address/domain, which we report below:

https[:]//collectedall[.]com/c/h7qCb.....


To conclude, we always urge you to be wary of advertisements/promotional messages that boast of "giving away" valuables, and to avoid clicking on suspicious links, which could lead to a counterfeit site that steals your most sensitive data.

A little bit of attention and glance, can save a lot of hassles and headaches..

We urge you NOT to be fooled by these types of e-mails, which, even though they use familiar and not particularly sophisticated approach techniques, if there is a resurgence, with reasonable likelihood more than a few unfortunates will be fooled.
 
We invite you to check the following information on phishing techniques for more details:

06/02/2024 08:55 - Phishing: the most common credential and/or data theft attempts in  February 2024...
02/01/2024 16:04 - Phishing: the most common credential and/or data theft attempts in  January 2024...
11/12/2023 09:39 - Phishing: the most common credential and/or data theft attempts in  December 2023...
03/11/2023 08:58 - Phishing: the most common credential and/or data theft attempts in November 2023...
03/10/2023 16:35 - Phishing: the most common credential and/or data theft attempts in October 2023...
05/09/2023 10:35 - Phishing: the most common credential and/or data theft attempts in September 2023...
01/08/2023 17:33 - Phishing: the most common credential and/or data theft attempts in August 2023...
03/07/2023 10:23 - Phishing: the most common credential and/or data theft attempts in July 2023...
07/06/2023 15:57 - Phishing: the most common credential and/or data theft attempts in  June 2023...
03/05/2023 17:59 - Phishing: the most common credential and/or data theft attempts in  May 2023...
05/04/2023 17:34 - Phishing: the most common credential and/or data theft attempts in April 2023...
03/03/2023 16:54 - Phishing: the most common credential and/or data theft attempts in  March 2023..

 Try Vir.IT eXplorer Lite

 

If you are not yet using Vir.IT eXplorer PRO, it is advisable to install Vir.IT eXplorer Lite -FREE Edition- to supplement the antivirus in use to increase the security of your computers, PCs and SERVERS.

Vir.IT eXplorer Lite has the following special features:

• freely usable in both private and corporate environments with Engine+Signature updates without time limitation;
• fully interoperable with other AntiVirus software and/or Internet Security products (both free and commercial) already installed on your computer. It doesn't need any uninstallation and it doesn't cause slowdowns, as some features have been appropriately reduced to ensure interoperability with the AntiVirus software already on your PC/Server. This, however, allows cross-checking through the scan;
• it identifies and, in many cases, even removes most of the viruses/malware actually circulating or, alternatively, allows them to be sent to the C.R.A.M. Anti-Malware Research Center for further analysis to update Vir.It eXplorer PRO;
• through Intrusion Detection technology, also made available in the Lite version of Vir.IT eXplorer, the software is able to report any new-generation viruses/malware that have set in automatically and send the reported files to TG Soft's C.R.A.M
• proceed to  download Vir.IT eXplorer Lite from the official distribution page of TG Soft's website.

 

VirIT Mobile Security AntiMalware ITALIAN for ALL Android^TM Devices

VirIT Mobile Security Italian Anti-Malware software that protects Android™ smartphones and tablets, from Malware intrusions and other unwanted threats, and empowers the user to safeguard their privacy with an advanced heuristic approach (Permission Analyzer).
 

TG Soft makes VirIT Mobile Security available for free by accessing the Google Play Store market (https://play.google.com/store/apps/details?id=it.tgsoft.virit) from which you can download the Lite version, which can be freely used in both private and corporate settings.

 

 You can upgrade to the PRO version by purchasing it directly from our website=> click here to order

 

Acknowledgements

TG Soft's Anti-Malware Research Center would like to thank all users, customers, reseller technicians, and all people who have transmitted/reported material attributable to Phishing activities to our Research Center, that allowed us to make this information as complete as possible.

How to submit suspicious emails for analysis as possible phishing but also virus/malware or Crypto-Malware

You can submit materials to TG Soft's Anti-Malware Research Center safely and free of charge in two ways:

1. any suspect email can be sent directly by the recipient's e-mail, to the following mail lite@virit.com,choosing as sending mode "Forward as Attachment" and inserting in the subject section "Possible phishing page to verify" rather than "Possible Malware to verify";
2. save the e-mail to be sent to TG Soft's C.R.A.M. for analysis as an external file to the e-mail program used. The resulting file must be sent by uploading it from the page Send Suspicious Files (http://www.tgsoft.it/italy/file_sospetti.asp). Obviously if you want a feedback on the analysis of the data submitted, you have to indicate an e-mail address and a brief description of the reason for the submission (for example: possiible / probable phishing; possible / probable malware or other).

For more details on how to safely forward suspicious e-mails, we invite you to consult the following public page: How to send suspicious emails for analysis
We provide all this information to help you prevent credential theft, viruses/malware or, even worse, next-generation Ransomware / Crypto-Malware.



TG Soft's C.R.A.M. (Anti-Malware Research Center)