cyber.hendryadrian.com
Security News · cert-agid.gov.it

CERT-AGID Reports 14 INPS Smishing Campaigns Linked to Darcula

· Original article ↗

Summary

CERT-AGID observed 14 campaigns impersonating INPS with fake fuel-subsidy messages. The mobile-only sites collect personal and payment-card data; technical artifacts suggest a link to the Darcula phishing platform.

Key points

  • CERT-AGID observed 14 campaigns using distinct domains over four days.
  • SMS messages impersonated INPS and lured recipients to smartphone-only sites advertising a fake €300 fuel subsidy.
  • The multi-step forms requested personal details followed by payment-card information, including the CVV.
  • CERT-AGID found obfuscated JavaScript and artifacts it says are compatible with the Darcula Phishing-as-a-Service ecosystem.
  • The report says data in POST requests was encrypted using a password-and-salt-based scheme, then Base64-encoded.
  • CERT-AGID notified INPS, requested takedowns from domain registrars, and shared indicators with accredited organizations.

Article Details

Event Type
Smishing campaign impersonating INPS with a mobile-first phishing flow linked by technical artifacts to the Darcula Phishing-as-a-Service ecosystem.
Impact
The fraudulent pages collect personal information and payment-card details, including CVV. The campaign's likely aim is unauthorized charges; the article does not confirm completed charges or quantify victims. CERT-AGID notified INPS, requested takedowns of the malicious domains, and shared indicators with accredited organizations.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationJavaScript files in the fraudulent flow were reported as obfuscated.T1041 · Exfiltration Over C2 ChannelThe article reports stolen data sent in POST requests in encrypted, Base64-encoded form.T1132.001 · Standard EncodingThe stolen data was reportedly encoded in Base64 before transmission.T1566.001 · Spearphishing AttachmentVictims are induced to click an external link in an SMS leading to a fraudulent page.T1657 · Financial TheftThe campaign collects payment-card details, apparently to facilitate unauthorized charges.

Tools

DarculaThe activity intensified over four days with 14 campaigns across distinct domains, and technical analysis showed links to the Darcula Phishing-as-a-Service ecosystem.