Phishing Campaign Uses Fake Health Ticket Refund to Steal Personal and Card Data
Summary
CERT-AGID identified emails impersonating Italy’s Ministry of Health with a fake €278.26 refund offer. Linked pages request identity, contact and payment-card details; CERT-AGID requested a takedown and shared indicators.
Key points
- The emails impersonate Italy’s Ministry of Health and claim recipients are owed €278.26 for a double payment of a healthcare fee.
- The spoofed sender address is [email protected], and the message directs recipients to a fraudulent refund page.
- The page requests tax code and birth date, then names, contact details, residential address and payment-card information, including CVV.
- CERT-AGID says the collected data could enable unauthorized card transactions or further targeted smishing, vishing and banking-phishing attempts.
- CERT-AGID requested that the hosting domain be taken down, informed the Ministry of Health and shared indicators with public administrations and accredited organizations.
Article Details
- Event Type
- Phishing campaign impersonating the Italian Ministry of Health with a fraudulent health-ticket refund lure.
- Impact
- The phishing pages collect victims’ tax codes, birth dates, contact and address details, and payment-card information. The stolen data could enable unauthorized card transactions and further targeted smishing, vishing, or banking-phishing campaigns.
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe sender identity and Ministry of Health branding are spoofed to make the message appear official.T1056.003 · Web Portal CaptureThe phishing website captures personal and payment-card data entered into its forms.T1566.002 · Spearphishing LinkThe fraudulent email directs recipients to click a link leading to the phishing website.