CERT-AGID Identifies Pharmacy Refund Phishing Campaign Impersonating Italy’s Health Record
Summary
CERT-AGID reports a phishing campaign impersonating Italian public services with a fake 19% pharmacy refund to collect personal and payment card data. It says it began takedown measures and shared indicators with public-sector organizations.
Key points
- The campaign impersonates Italy’s Electronic Health Record and several government bodies.
- A fake 19% pharmacy reimbursement, shown as €20.73, is used as the lure.
- The site uses a CAPTCHA, fake reimbursement notice, personal-data form and payment-card form.
- Requested details include identity and contact information, card number, expiry date and CVV.
- A fabricated confirmation cites a protocol number, an “In processing” status and a false support number.
- CERT-AGID says it launched measures to take down the malicious domain and shared indicators with public administrations and accredited organizations.
Article Details
- Event Type
- Phishing campaign impersonating Italian public institutions
- Impact
- The campaign harvests victims’ personal information and payment card details, which attackers could use for fraudulent transactions, resale in illicit networks, and further targeted social engineering.
MITRE ATT&CK
T1036 · MasqueradingThe phishing site uses institutional logos and graphics to impersonate public services.T1056 · Input CaptureWeb forms capture victims’ personal information and full payment card details.T1204 · User ExecutionVictims are prompted to click “Confirm” to proceed through the fraudulent reimbursement flow.T1566 · PhishingThe campaign uses a fraudulent website to phish victims.