CERT-AGID Reports SPID Phishing Campaign Targeting Public Administrations
Summary
CERT-AGID identified phishing impersonating Agenzia delle Entrate–Riscossione, using a fake SPID login to steal passwords. It notified the affected entity, sought takedown of the site and shared IoCs.
Key points
- The campaign impersonates Agenzia delle Entrate–Riscossione and targets public administrations as well as private organizations.
- Deceptive messages link to a fake SPID login page that displays the AgID logo.
- Personalized links prefill the victim’s email address, while the page asks for their password.
- CERT-AGID notified the affected entity and requested that the phishing site be taken down.
- CERT-AGID distributed campaign IoCs through its feed to accredited organizations.
- The article recommends multi-factor authentication and staff awareness to reduce risk.
Article Details
- Event Type
- Targeted phishing campaign impersonating Agenzia delle Entrate–Riscossione and using a fraudulent SPID login page to harvest credentials.
- Impact
- Compromised credentials could enable unauthorized access to mailboxes and institutional systems, potentially resulting in sensitive-data exfiltration or alteration of official documents, with legal, reputational, and operational consequences.