CERT-AGID Warns of PagoPA Fine Phishing Using Compromised PEC Accounts
Summary
CERT-AGID reports PagoPA fine phishing sent from compromised PEC accounts. Fake portals collect personal data and may guide victims to payment-card pages; CERT-AGID has shared campaign indicators and advises checking payment requests through official channels.
Key points
- In two analyzed cases, compromised certified email (PEC) accounts sent fake traffic-fine payment requests to ordinary email addresses, copying about 340 PEC addresses.
- The messages impersonated an administrative traffic-fine notice, demanding €198 and threatening an increase to €268 for late payment.
- Links led to fraudulent .ru-domain sites mimicking PagoPA and requesting personal information; further screens may seek payment-card details and banking verification codes.
- A page script checked a server-side panel every half-second for redirection instructions, potentially letting attackers guide victims through the fraud.
- CERT-AGID counted 1,874 fine-themed phishing campaigns impersonating PagoPA and SEND since April 21, 2025, and distributed 14,279 IOCs to accredited public administrations.
- CERT-AGID is coordinating countermeasures with PEC providers and recommends verifying payment requests through official channels rather than message links.
Article Details
- Event Type
- Phishing campaigns impersonating PagoPA and SEND, including campaigns distributed through compromised PEC accounts.
- Impact
- The fraudulent pages solicit victims’ personal information and may direct them to pages collecting payment-card details and bank verification codes. CERT-AGID reported 1,874 fines-themed campaigns since 2025-04-21 and shared 14,279 indicators of compromise with accredited organizations.