CERT-AGID Warns of INPS Phishing Campaign Using Fake €730 Refund
Summary
CERT-AGID reports an email phishing campaign impersonating INPS with a fake €730 refund. A counterfeit site collects personal and card details, then urges victims to approve a banking push notification; takedown efforts are underway.
Key points
- The campaign impersonates Italy’s INPS in emails claiming recipients are owed a €730 refund for a tax and contribution recalculation.
- The emails use an urgent deadline and a link to a counterfeit INPS portal hosted at feedsafepro[.]com.
- The site collects identity and payment-card details, including card number, expiry date, and CVV.
- The final page asks victims to approve a banking-app push notification within 60 seconds, purportedly to verify their identity.
- CERT-AGID began takedown efforts and shared indicators of compromise with public administrations and accredited organizations.
Article Details
- Event Type
- Email phishing campaign impersonating INPS with a fake refund process.
- Impact
- The site solicits personal, tax, and payment-card information, then attempts to persuade victims to approve an unauthorized banking transaction through a push notification.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | feedsafepro[.]com | Domain identified as hosting the fake INPS refund and data-collection site. |
MITRE ATT&CK
T1036 · MasqueradingThe fraudulent site mimics the INPS portal and presents a fake refund procedure.T1056.003 · Web Portal CaptureThe fake web portal captures personal and payment-card information through multi-step forms.T1566.002 · Spearphishing LinkPhishing emails direct recipients to the malicious refund site through a link.