Antiphishing.biz

This phishing campaign impersonates dao, a Danish parcel delivery service. The scam uses a fake “delivery failed” notification to trick victims into providing personal information, which can later be used for identity theft or to redirect victims to a payment page where credit card details are stolen.

How it works:

Fake Tracking Page – The victim receives an SMS or email with a link to a fake tracking page. The page displays a fake tracking number and a false status (e.g., “Delivery attempt failed”).

Delivery Failure Notice – The victim is informed that the package could not be delivered because the address was unclear. A button or link (e.g., “Update Address”) is presented.

Address Update Form – The victim is taken to a page that asks for personal details: first name, last name, street address, city, postal code, email, and phone number (with Danish country code +45 pre‑filled).

Potential Next Step (not fully shown) – After submitting the address, the victim may be redirected to a payment page requesting card details (e.g., a small “redelivery fee”). This is a common pattern.

The goal:
The attacker collects:

Full name, address, postal code, city

Email address and phone number

With this information, the attacker can:

Sell the data to other criminals

Use it for identity theft

Target the victim with follow‑up scams (e.g., fake bank calls)

If a payment page follows, also steal credit card details

Red flags to watch for:

Suspicious URL: The pages are hosted on domains that are not dao.dk or the official dao website. The visible fragments (e.g., 135.2.tv, 135.1.tv) suggest a subdomain or odd URL structure.

Unsolicited delivery failure notification: dao does not send links to update addresses via SMS or email. Legitimate delivery issues are handled through the official tracking system or by contacting customer service directly.

Fake tracking number: The tracking number (CP318587863DK) is fabricated and cannot be verified on the real dao website.

Request for personal information before delivery: A legitimate courier already has your address. They will not ask you to re‑enter it via a link in a message.

Generic design / copied content: The pages use dao’s branding, navigation menus, and help section links, but these are copied from the real site. The domain is the giveaway.

What to do if you encounter this:

Do not enter any personal information (name, address, email, phone).

If you have already entered such information, be aware that it may be used for identity theft or follow‑up scams.

If you were redirected to a card payment page and entered card details, contact your bank immediately to block your card.

Always track packages by typing the official courier URL directly (e.g., dao.dk) and entering your real tracking number.

Report the phishing page to dao’s customer service.

Protective measures:

Never click links in unsolicited delivery messages. Always go directly to the official courier website.

Never provide your address, email, or phone number in response to a delivery notification link.

Check the URL carefully: Official dao domains end with dao.dk. Look for misspellings, extra words, or unusual top‑level domains (e.g., .tv, .th).

Enable two‑factor authentication on your email and banking accounts.

🛡️ Phishing Alert: The “Agency Complaint Matrix” Trap## Target: Customers and Employees of French Banking Groups (Crédit Agricole)

Our AI-engine, Miniban, has detected a highly sophisticated spear-phishing campaign hosted on GitHub Pages. This attack mimics internal banking tools to bypass standard security filters and steal sensitive financial data.

1. The “Trusted Host” Camouflage

Scammers are using the domain github.io to host their landing pages.

• The Deception: Because GitHub is a legitimate platform used by developers worldwide, many corporate firewalls do not block these links by default.
• The Tactic: The URL lumialous.github.io/matrice_reclamations_agences/ is designed to look like a professional internal resource for handling “Agency Complaints” (Réclamations Agences).

2. How the Attack Works (The “Complaint” Hook)

Unlike common phishing that offers “prizes,” this campaign uses negative social engineering.

• The Hook: Victims are contacted via SMS or Email regarding a “filed complaint” or a “security issue” with their account.
• The Trap: Users are directed to this fake “Matrix” page to “verify” their identity or “cancel” a fraudulent transaction.
• The Theft: The page features a perfect clone of the bank’s login interface. Once you enter your credentials, attackers gain full access to your online banking, including the ability to intercept 3-D Secure codes.

3. Why it is Sophisticated

This is part of a Multi-Stage Attack. We have linked this specific GitHub page to recent fraudulent activity involving high-risk 3DS relay intercepts. By using terms like “Matrice” and “Réclamations,” scammers target the victim’s sense of urgency and professional duty.

🚩 How to Protect Yourself:

• Check the Domain: A real bank will never host its login or complaint forms on github.io, vercel.app, or other free hosting providers. Official banking services only operate on their verified private domains (e.g., credit-agricole.fr).
• Verify the Source: If you receive a link about a “complaint” you didn’t file, do not click it. Log in to your bank’s official app or website directly.
• Look for SSL Details: While the site may have a green lock (HTTPS), clicking it will show the certificate belongs to “GitHub, Inc.,” not your bank.

Technical Analysis for Pros:

• Incident ID: PH-FR-8842
• Threat Type: Credential Harvesting / Spear Phishing
• Platform Abuse: GitHub Pages
• Miniban Risk Score: 10/10 (Critical)

___________________________________

🛡️ Alerte au Phishing : Le piège de la “Matrice de Réclamations”## Cible : Clients et employés des groupes bancaires français (Crédit Agricole)

Notre moteur d’intelligence artificielle, Miniban, a détecté une campagne de phishing (hameçonnage) sophistiquée hébergée sur GitHub Pages. Cette attaque imite les outils internes de gestion bancaire pour contourner les filtres de sécurité classiques et voler des données financières sensibles.

1. Le camouflage sur un hôte de confiance

Les escrocs utilisent le domaine github.io pour héberger leurs pages de destination.

• La tromperie : GitHub étant une plateforme légitime utilisée par les développeurs du monde entier, de nombreux pare-feu d’entreprise ne bloquent pas ces liens par défaut.
• La tactique : L’URL matrice_reclamations_agences est conçue pour ressembler à une ressource professionnelle interne dédiée à la gestion des “Réclamations Agences”.

2. Fonctionnement de l’attaque (L’appât de la “Réclamation”)

Contrairement au phishing classique qui promet des “cadeaux”, cette campagne utilise une ingénierie sociale basée sur l’urgence.

• L’accroche : Les victimes sont contactées par SMS ou e-mail concernant une “réclamation déposée” ou un “problème de sécurité” sur leur compte.
• Le piège : L’utilisateur est dirigé vers cette fausse page de “Matrice” pour “vérifier” son identité ou “annuler” une transaction frauduleuse.
• Le vol : La page contient un clone parfait de l’interface de connexion de la banque. Une fois vos identifiants saisis, les attaquants accèdent à votre compte et peuvent intercepter les codes 3-D Secure.

3. Pourquoi cette attaque est-elle redoutable ?

Elle fait partie d’une attaque en plusieurs étapes. Nous avons lié cette page GitHub à des activités frauduleuses récentes impliquant l’interception de relais 3DS. En utilisant des termes techniques comme “Matrice” et “Réclamations”, les fraudeurs exploitent le sens du devoir professionnel et l’inquiétude de la victime.

🚩 Comment vous protéger :

• Vérifiez le domaine : Une banque ne demandera jamais de vous connecter via des plateformes comme github.io, vercel.app ou d’autres hébergeurs gratuits. Les services officiels n’opèrent que sur leurs domaines privés vérifiés (ex: credit-agricole.fr).
• Vérifiez la source : Si vous recevez un lien concernant une “réclamation” que vous n’avez pas déposée, ne cliquez pas. Connectez-vous directement via l’application officielle ou le site web de votre banque.
• Inspectez le certificat SSL : Même si le site affiche un cadenas (HTTPS), un clic sur celui-ci révélera que le certificat appartient à “GitHub, Inc.” et non à votre banque.

Analyse technique :

• ID de l’incident : PH-FR-8842
• Type de menace : Vol d’identifiants / Spear Phishing
• Abus de plateforme : GitHub Pages
• Score de risque Miniban : 10/10 (Critique)

Below is a description of the Norwegian BankID phishing campaign shown in the screenshots. The attack attempts to harvest multiple layers of authentication data.

Threat Analysis: BankID Phishing – Full Credential & 2FA Harvesting (Norwegian Variant)

This multi‑step phishing campaign impersonates BankID, the common Norwegian electronic identification system used by most banks. The attacker’s goal is to collect enough information to log into the victim’s online bank and authorise fraudulent transactions.

How the attack works (six‑step flow):

1. Fødselsnummer (national ID) – The victim’s 11‑digit personal identification number is requested.
2. Phone number – The victim is asked to enter their phone number (linked to BankID).
3. Choice of BankID method – The victim selects between using the BankID app or a kodebrikke (physical code generator).
4. If “app” is chosen – The victim sees a page stating “Godkjenn med din BankID‑app” (Approve with your BankID app). This is a waiting step, while the attacker uses the previously collected data to trigger a real push notification in the official app.
5. If “kodebrikke” is chosen – The victim is asked for their BankID password (the one used with the physical code generator).
6. Additional steps – Depending on the variant, the attacker may also ask for a response from the code generator or for an SMS‑code, all captured in real time.

The goal:
The attacker collects:

• Phone number (used to identify the victim in the banking system)
• National ID number (fødselsnummer)
• BankID password (if the code generator method is used)
• In the case of the app method, the attacker will also capture the push‑notification approval (by tricking the victim into approving a fraudulent login or transaction).

With this information, the attacker can:

• Log into the victim’s bank account
• Authorise payments or money transfers
• Commit identity theft or sell the data

Red flags to watch for:

• Suspicious URL: The pages are hosted on myntro-gebyr.com (and subdomains), not on any official Norwegian bank or BankID domain (e.g., bankid.no).
• Unsolicited request: You should never receive a link to enter your BankID credentials. Real BankID authentication always starts from the bank’s official website or app, not from an external link in a message.
• Multiple steps with increasing sensitivity: A legitimate BankID login asks for either a single push notification or a one‑time code, not for phone number, national ID, password, and choice of method all in one session.
• Mixed Norwegian / English wording: Official BankID pages are consistently in Norwegian (Bokmål or Nynorsk). The presence of “ID‑porten” (the national authentication portal) is real, but the URL gives it away.
• No personalisation: Legitimate BankID steps show a partially masked name or a known device – this page does not.

What to do if you encounter this:

• Do not enter any personal information, BankID password, or approve any request from your BankID app.
• If you have already entered your phone number and fødselsnummer, contact your bank immediately to block your BankID.
• If you have entered your BankID password, change it immediately (through the official bank website, not via any link).
• If you approved a push notification from your BankID app, call your bank’s fraud department immediately – the attacker may already have authorised a transaction.
• Always access BankID by typing your bank’s official URL directly or by using the official BankID‑app without any external link.

Protective measures:

• Never click links in unsolicited messages claiming payment issues, package delivery, or account problems – especially if they ask for BankID.
• Use a password manager – it will not autofill on fake domains.
• Enable BankID with push notifications (app) – and never approve a request unless you have just initiated a login yourself.
• Check the URL carefully – legitimate BankID pages are on bankid.no or your bank’s domain.
• If in doubt, contact your bank directly using a phone number from your bank card or official website – never use numbers from a suspicious message.

Below is a description of this phishing campaign targeting Posti (the Finnish postal service) and using a fake bank authentication page to steal avainluku (key number) credentials.

Threat Analysis: Posti Phishing – Fake “Key Number” Authentication Scam (Finnish Bank Credential Theft)

This phishing campaign impersonates Posti, the Finnish postal service. The scam uses a fake “key number list” (avainlukulista) authentication page – a method commonly used by Finnish banks – to steal the victim’s online banking credentials.

How it works:

Step 1 – Fake Key Number Request Page (First Screenshot)

The victim receives a phishing email, SMS, or other message claiming a package is waiting, a delivery fee is required, or a payment needs to be confirmed. The link leads to a page that mimics the Posti website. The page asks the victim to enter a specific key number from their bank’s key number list – in this case, “208. avainluku” (key number 208). This is a direct attempt to capture one of the one‑time codes used to authenticate banking transactions.

Step 2 – Fake “Processing” Waiting Page (Second Screenshot)

After the victim submits the key number, they are taken to a page claiming that their information is being processed and that they should not leave the page. A waiting time of up to 15 minutes is displayed. This page is designed to:

• Buy time for the attacker to use the stolen key number to log into the victim’s real bank account
• Reduce suspicion – the victim believes the process is legitimate and ongoing

The goal:
The attacker aims to:

• Steal a specific key number (one‑time code) from the victim’s bank key number list
• Use that code, together with other information (possibly captured in earlier steps not shown), to log into the victim’s bank account
• Transfer funds or commit fraud

Red flags to watch for:

• Suspicious URL: The pages are hosted on a domain that is not posti.fi – the official Posti domain.
• Request for bank key number on a postal service page: Posti does not ask for your bank’s avainluku numbers. This is a clear sign of a phishing page trying to harvest banking credentials.
• Unsolicited request: Posti does not send links requiring customers to enter bank authentication codes to release a package or confirm a payment.
• Generic waiting page with a timer: A legitimate postal service does not display such a page after you submit a code. This is a classic stalling tactic used by phishing kits.
• Copied content: The pages use Posti’s logos, navigation menus, and social media links, but these are stolen from the real site.

What to do if you encounter this:

• Do not enter any key numbers or other banking codes.
• If you have already entered a key number, contact your bank immediately – the code may have already been used to authorise a fraudulent transaction.
• Always access Posti services by typing posti.fi directly into your browser.
• Never enter bank authentication codes on a site that is not your bank’s official website.

Protective measures:

• Bookmark the official Posti website and use that bookmark.
• Never enter your bank’s key numbers (avainluku) on any third‑party site – not even if the site looks like a familiar postal service.
• Use a password manager – it will not autofill on fake domains.
• Enable two‑factor authentication through your bank’s official mobile app instead of relying solely on key number lists if possible.
• Be suspicious of any unsolicited message that asks you to log in or enter a key number via a link.