CERT-AGID Warns of Adaptive Phishing and Vishing Campaign Impersonating Italy’s Revenue Agency
Summary
CERT-AGID reports active campaigns impersonating Italy’s Revenue Agency to collect tax, crypto, and banking details; one uses an adaptive fake portal and a bogus error message to prompt victims to call a fraudulent office.
Key points
- The campaigns impersonate the Revenue Agency and use an alleged mandatory crypto-asset declaration, sometimes with urgent deadlines, as a lure.
- The fake portal first asks for the victim’s tax code and mobile number.
- Depending on the victim’s response, the form requests crypto wallet or exchange details and asset value, or bank name and account balance.
- A simulated synchronization error warns of possible assessment and asset-freeze consequences, then urges the victim to call a number presented as the “Milan Verification Office.”
- CERT-AGID requested takedowns of the malicious domains, notified the Revenue Agency, and shared indicators with entities accredited to its feed.
Article Details
- Event Type
- Active phishing and vishing campaigns impersonating Agenzia delle Entrate
- Impact
- The campaigns seek to collect victims’ tax codes and mobile numbers, followed by cryptocurrency wallet or exchange details and asset values, or bank names and account balances. Victims are then urged to call a fraudulent office number. CERT-AGID requested takedowns and informed Agenzia delle Entrate; the article does not report confirmed victim losses.
MITRE ATT&CK
T1204.001 · Malicious LinkThe attack flow depends on victims visiting the deceptive website and submitting information.T1566.002 · Spearphishing LinkVictims are directed to a fake institutional website impersonating Agenzia delle Entrate.T1598 · Phishing for InformationThe phishing form requests tax and contact details, then cryptocurrency or banking information.T1656 · ImpersonationThe campaign impersonates Agenzia delle Entrate and a purported Milan Verification Office to induce victims to call.