SMS phishing might not sound like much of a threat. People could think that, after all, who still uses SMS nowadays? In reality, though, SMS remains a vital channel of communication for many businesses and even some institutions. Criminals often try to spread their fraudulent campaigns using SMS and messages relevant to our times.
Scam Alert, one of the many features available in Bitdefender Mobile Security for Android, notifies users when they receive a message containing suspicious links that might attempt to steal financial data, credentials and other sensitive information.
All cross-platform products included in Bitdefender Total Security benefit from Scam Alert's detections as the information quickly disseminates to the entire user base as soon as a single URL is identified as dangerous.
Criminals tailor their messages to the region they're targeting. In some countries, they might try to trick people into thinking the message is related to energy prices. In others, they might write about tracking packages or send users to website hosting malware. The messages criminals use in every campaign change depending on the public's interest. For example, as we approach the holiday season, expect a plethora of SMS messages warning about lost packages.
Criminals build their campaigns knowing that any links they provide have a high chance of being detected, so they change the message wording and links in an attempt to remain anonymous. Bitdefender has been working on a security research technology that can identify and group messages that seemingly have nothing to do with one another but are, in fact, part of the same campaign from the same operators.
This technology is instrumental when criminals use the socio-political landscape to craft messages, exploiting the energy crisis and trick people into clicking on malicious links.
We looked closely at all the major SMS phishing campaigns of the past 30 days worldwide that our Scam Alert telemetry caught in its net, including in the first weeks of November. The telemetry contains everything from energy bill scares to lost packages and everything else in between.
One common theme you'll notice is the URLs used in the attacks. Most of them have legitimate-sounding words in the link address to trick people into thinking they're accessing an official domain when, in fact, they're controlled by attackers who just want to steal information. Many of the domains shown in this research don't work anymore, but new ones pop up every day, which is why it's essential to find and group them as quickly as possible.
UK Energy Bills Phishing
In the UK, the most prevalent scam targets people's concerns around electricity bills. The government has already issued warnings, but the scams continue to spread. Criminals use the accurate information that the UK government is offering a £400 grant in some situations but pervert the message to fit their phishing campaign.
This phishing campaign in Germany also focuses on energy bills, but it's tailored to Germans, with scammers trying to impersonate the Federal Ministry of Finance. The messages say the user will receive a sum of money or a refund related to their energy bill if they click the link. When opened, the links redirect to a fake website purporting to be the Federal Ministry of Finance. There, users are asked to input their bank account data to receive the money. The officials have warned that no such payments exist and that users must not give out their data.
When the website is opened, the user must confirm they are not a robot and submit a captcha.
Then, the user enters the website and sees the logo of the Federal Ministry of Finance, along with a list of banks. From there, the user is prompted to log in to their bank account to receive the payment.
If the user clicks on a bank, a phishing page opens, imitating the real bank’s login pages. Even though the login forms resemble the official ones, the address bar shows that we are still on the first site, which imitates the Federal Ministry of Finance, and not on the banking one.
French Health Insurance Scam
Malware is not the only threat in France. An active phishing campaign mimics the Social Security Website, asking users for personal data to receive reimbursement or to renew their expiring insurance. Authorities have already issued a warning to users and given them examples of malicious SMS messages.
UK Covid SMS
Despite reduced interest in Covid-related news, scammers continue to use the pandemic in phishing attempts. Users are tricked into thinking they will receive a free Covid-19 test kit if they just pay a small amount for delivery or are told that they have been in contact with an infected person and can take a free test. The real website is nhs.uk, whereas the links in the SMS messages lead to look-a-like pages. The NHS has issued warnings on its Twitter page about these ongoing scams.
France Air Pollution Certificate Scam
A Crit'Air sticker (air quality certificate) is mandatory when driving through low-emissions zones in France. Drivers can be tricked into giving their data to scam websites through links received via SMS if they don't pay attention. The official website states, "You can be sure that you are on the official site if the ministry's logo is displayed and the site address ends in .gouv[.]fr."
Spain Tax Agency Phishing
Spanish users have received text messages, purportedly from the Tax Agency, that claim they are eligible for tax reimbursement. A list of current phishing attempts involving the Tax Agency has been posted on its official website.
The phishing website displays the logo of the Tax Agency and states that the user is eligible for a €461 tax reimbursement. The links below in the blue box lead to the exact page where the user inputs their data.
Australian Toll Road Scams
Drivers in Australia have been receiving messages claiming they've missed a deadline to pay toll road fees or that their account has been banned. The toll road authority has posted warnings of a series of ongoing scams.
Even though the page resembles the official one, when checking the links below, we can see that they do not point anywhere.
BNP Paribas Phishing in France
Spain Banks Scam
The official site of BBVA sent a warning last year, but scams are still ongoing. The messages are entangled with the official messages that the bank sends to customers, making them very hard to detect.
Banks targeted with this scam:
• Kutxa Bank
• Unicaja Banco
• Evo Banco
• GrupaCaja Rural
Italy Bank Scams
Canada Royal Bank Scam
Apple Pay Scam in the UK
Of course, phishing isn't the only threat circulating via SMS in the UK. Also common are scams focused on Apple Pay accounts, trying to trick users into giving out their personal information to log back in.
Amazon Scam in the UK
A scam focused on deactivated Amazon accounts, where users are tricked into giving out personal information to log back in, is very similar to the PayPal version.
Netflix Refund Scam in US
The scammers behind the messages use the allure of a refund to entice people into clicking on the link to the malicious website — where they could be tricked into entering their personal and financial information. Any information entered into the site will be available to scammers.URL Example:
Netflix Scam in France
A similar scam is circulating in France, with criminals trying to persuade victims to re-enter their credit card details under the threat of deactivating their Netflix account.
Roaming Manties targeting France
While many phishing campaigns try to redirect people to fake websites that collect private information, criminals sometimes redirect people to malware. In this campaign, which started in Asia but reached Europe this year, the malware is called Roaming Manties.
Roaming Manties was observed in France in July this year and is still targeting French users. The attack is widespread, having been received over 90,000 times since September by users with Scam Alert.
Unlike the UK and Germany, most messages carrying these links mention package delivery issues or notifications.
EMAG/Altex scam in Romania
Romania is also an active target for phishing and similar threats. Fraudsters use the likeness of a couple of well-known online marketplaces to trick people. Users receive a personalized message about a prize they received that must claim, containing their name and phone number.
If the user accepts the prize, he is asked to choose the delivery option:
To complete the transaction, the victim has to fill in the address and offer other personal information.
Finally, the user is asked for credit card information:
Phishing schemes in Italy and other countries
This fraud seems to be from the same group behind the Altex/Emag attack in Romania.
Fake GLS website:
Information about a package delivery:
User must pay 2 euro delivery tax:
User can choose to receive the package at home or to pick it up:
Delivery on the weekend or during work days:
Last step, address and payment information:
Fake Delivery Mexico
Fake Prizes Scam in South Africa
The promise of great prizes is an obvious tactic, but these phishing websites only work with a VPN, from South Africa. If the websites are accessed from another region, they redirect to Google.
Fake Prizes Scam in Poland
A similar campaign takes place in Poland. The same rule applies; it's only available from a Polish IP via VPN.
A few of the phishing websites work without VPN.
Package Tracking Phishing in Spain
In this phishing scheme, criminals ask users to pay a delivery fee to receive a package and give out their credit card information. The phishing website also offers the option to download an app that takes you to the official Google Play Store.
Romania postal scam
UPS scams are also widespread in the US and are very similar to the ones above.
Singapore Post scam
The official Singapore postal service website has already issued a warning. SMS notifications are being replaced with push notifications from the official app.
We find more examples in Australia and France
I'm a Security Researcher at Bitdefender, and when I'm not looking at code, I spend my time enjoying a good book, traveling, and swimming.View all posts
I'm a Junior Security Researcher at Bitdefender, and I usually spend my free time reading, playing the piano, solving chess puzzles, or learning a new language.View all posts
Silviu is a seasoned writer who followed the technology world for almost two decades, covering topics ranging from software to hardware and everything in between.View all posts
January 11, 2023
January 05, 2023
December 06, 2022
October 05, 2022
February 28, 2023
February 23, 2023