Convincing phishing emails target Free Mobile customers after data breach

Summary

A polished phishing campaign impersonates Free Mobile, claiming customers owe €9.99 and directing them through redirects to fake payment pages that collect card details. The article describes several campaign domains and offers safety advice.

Key points

The emails imitate Free Mobile’s branding and claim a €9.99 invoice must be paid to avoid service suspension.
The observed message came from freemobile-regularisation@knowledgegrowthcenter.help, not an official Free Mobile address.
Links pass through redirectors to lookalike domains, including espace-free-mobile.pro, freesas.info, and regularisation-free.info.
The final pages request credit card details; the article says the domains were recently registered and hosted by Cloudflare.
The campaign follows Free Mobile’s October 2024 breach, which exposed customer records including bank details and login information; the article does not establish a direct link between the breach and this campaign.
Customers should avoid unsolicited invoice links, visit mobile.free.fr or the official app directly, and verify the browser’s actual domain.

Article Details

Event Type: Phishing campaign impersonating Free Mobile through convincing emails and fake payment pages.
Impact: The campaign attempts to obtain customers’ credit card details by claiming an unpaid invoice must be paid to prevent service suspension. It follows an October 2024 breach that exposed customer records, including bank account details and login information.

Indicators of compromise

Type	Indicator	Context
URL	`hxxps[:]//bly[.]to/93kie5u`	URL in an earlier example of the phishing campaign’s redirect chain.
URL	`hxxps[:]//bly[.]to/jabwpf6`	URL in another phishing redirect chain leading to a fake Free Mobile payment page.
URL	`hxxps[:]//espace-free-mobile[.]pro/Ds41LE/302`	Redirect URL in the phishing chain leading to the fake Free Mobile payment page.
URL	`hxxps[:]//freesas[.]info/Cf4tP/`	Phishing redirect URL leading to a fake Free Mobile payment page.
URL	`hxxps[:]//regularisation-free[.]info/portail/`	Phishing URL leading to a fake Free Mobile payment page.
URL	`hxxps[:]//s[.]ink/jmCnZZ`	URL in a more recent phishing redirect chain leading to a fake Free Mobile payment page.
URL	`hxxps[:]//s1181402[.]ha026[.]t[.]mydomain[.]zone/mbl/`	Phishing redirect URL used in an earlier campaign example.
URL	`hxxps[:]//u2l[.]ai/Q5YwFz301`	Redirect URL in the phishing email’s chain leading to the fake Free Mobile payment page.