Threat Analysis: Naranja X Phishing – Fake Login Page Stealing Email and Password
This phishing campaign impersonates Naranja X, a popular digital financial platform in Argentina that offers credit cards, loans, and digital accounts. The page mimics the platform’s login interface to steal customers’ email address and password.
How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Naranja X login page. When the victim enters their email and password and clicks “Iniciar sesión” (Log in), the credentials are captured and sent to the attacker.
The goal:
The attacker aims to steal the victim’s Naranja X account credentials. With these, they can:
- Log into the victim’s Naranja X account
- Access linked credit cards and financial services
- Make unauthorized purchases or transfers
- Obtain personal information for identity theft
Red flags to watch for:
- Suspicious URL: The page is hosted on a domain that is not
naranjax.com.aror any official Naranja X domain. Legitimate Naranja X online access is through the bank’s official website or mobile app. Always check the address bar. - Unsolicited login request: Naranja X does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access their accounts by typing the official URL directly or using the official app.
- Minimal design: While the page includes the Naranja X logo, it lacks the full branding, navigation menus, security notices, and personalized elements present on the legitimate login page.
- Missing security features: Legitimate Naranja X login pages typically include additional security elements such as a virtual keyboard, CAPTCHA, or multi-factor authentication prompts. This page has only a basic form.
- Generic form: The page asks only for email and password without any account-specific personalization or security verification.
What to do if you encounter this:
- Do not enter your email, password, or any other personal information on this page.
- If you are a Naranja X customer, always access your account by typing
naranjax.com.ardirectly into your browser or by using the official Naranja X mobile app. - If you have already entered your credentials, contact Naranja X immediately through their official customer service hotline to secure your account and change your password.
- Report the phishing page to Naranja X’s fraud department.
Why this scam is effective:
Naranja X has millions of users in Argentina, and its digital-first approach means many customers are accustomed to logging in via email and password. The page uses the brand’s recognizable logo and simple, clean design. The straightforward login form mirrors the actual Naranja X interface, making it easy for a distracted user to enter credentials without checking the URL.
Protective measures:
- Bookmark the official Naranja X login page and use that bookmark to access your account—never click links in emails or messages.
- Use a password manager: It will autofill only on legitimate
naranjax.com.ardomains, not on phishing sites. - Enable two-factor authentication (2FA) on your Naranja X account if available, to add an extra layer of protection.
- Be suspicious of any unsolicited message that creates urgency and asks you to log in to your account.
- Check the URL carefully: Legitimate Naranja X domains end with
naranjax.com.ar. Look for misspellings, extra words, or unusual top-level domains. - If in doubt, contact Naranja X directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.