CERT-AGID Details INPS-Themed Smishing Campaigns With Two Payment Lures
Summary
CERT-AGID reports smishing pages impersonating INPS that request personal and payment-card data. Two designs demand €385.40 or €6.60; the differences may reflect A/B testing, affiliate use, or separate SMS lists.
Key points
- SMS links lead to pages mimicking INPS’s “Visualizzazione indebiti” service.
- The pages request a Codice Fiscale, show a fake debt and payment code, then solicit card details and a phone number.
- Two observed designs request €385.40 and €6.60; CERT-AGID says the difference may be intended to test payment lures or reflect separate operators or recipient lists.
- CERT-AGID requested takedowns of the malicious domains and shared indicators with accredited entities; most registrars had acted at the time of reporting.
- CERT-AGID advises recipients not to click such links or provide personal or payment information.
Article Details
- Event Type
- Smishing and phishing campaign impersonating INPS
- Impact
- Fake debt-payment pages sought victims’ tax codes, personal information, phone numbers, and payment-card details, potentially enabling fraudulent payments and misuse of stolen data.
MITRE ATT&CK
T1036 · MasqueradingThe fraudulent pages used INPS branding and imitated the official portal’s debt-visualization section.T1204.001 · Malicious LinkVictims were prompted to click an SMS link and interact with the fraudulent page.T1566.002 · Spearphishing LinkThe campaign sent SMS messages containing links to fraudulent INPS-mimicking websites.