Antiphishing.biz

This phishing campaign targeting Ecuador’s Banco del Pacífico uses a fake “Intermático Security Sync” page to steal online banking credentials, security challenge questions, and One-Time Passcodes (OTP). Scammers employ a “sync” pretext in emails or SMS, directing victims to a malicious website that mimics the legitimate site to bypass multi-factor authentication and gain full account control. For protection, users must always access banking services by manually typing the official URL and never enter credentials through links provided in messages.

This phishing case highlights a sophisticated Real-Time Token Interception attack, where attackers use a fake Banco del Pacífico portal to steal credentials and prompt for 6-digit OTP security codes in real-time. By acting as a live “middleman,” the attacker uses the intercepted code to authorize fraudulent transfers or register a new device instantly, rather than just stealing credentials for later use.

Expert Security Tip:

Real-Time Session Hijacking
If a website asks for a Token/OTP code immediately after you log in, and you have not initiated a transfer, it is a major red flag indicating a scam. Always type the official bank URL directly into your browser, as Banco del Pacífico will never ask for security tokens to “verify” your profile via an email or SMS link.

A phishing campaign targeting Banco Sabadell users in Spain employs SMS and email, mimicking a security update to steal credentials and Digital Signature (Firma Digital) codes. The attack uses lookalike domains, such as sabadell-online-seguridad.net or acceso-bancosabadell.com, to redirect victims to a Man-in-the-Middle site designed to harvest login data and authorize fraudulent transfers in real-time.

A Sabadell Bank phishing campaign uses SMS-based social engineering to falsely warn customers of a blocked account, directing them to a fake, pixel-perfect site designed to steal login credentials and digital signatures in real-time. This sophisticated scam tricks users into entering their app-generated security codes to authorize unauthorized wire transfers. Users are advised to avoid clicking links in SMS messages and only use official app channels.

This Banco Sabadell phishing case highlights a real-time Man-in-the-Middle attack, where criminals use urgent smishing tactics to steal credentials and SMS OTP codes instantly to authorize fraudulent transactions. Users must understand that SMS security codes are used for authorizing transactions, not for logging in, and that banks never send login links via text. To protect accounts, always log in manually via the official website and carefully read the purpose of every SMS code before entering it.

Crédit Mutuel de Bretagne (CMB) “Security Key” Phishing
Target: Customers of Crédit Mutuel de Bretagne (France / Brittany region)
Threat Level: Critical (Real-time Account Takeover & “Clé Digitale” Hijacking)
Phishing Method Description
This attack targets users of the CMB Online Banking and the “CMB suivi de compte” mobile app. Scammers use a “Security Alert” pretext, sending out Smishing (SMS) messages claiming that an “unauthorized transaction” has been detected or that the user’s “Digital Key” (Clé Digitale) must be synchronized immediately to avoid account suspension.
The link leads to a professional-looking clone of the CMB portal, featuring the distinctive red and grey triskelion-style logo. This sophisticated phishing kit is designed to harvest:
Identifiant / Login ID
Password / PIN: Captured via a fake interactive virtual keyboard that mimics the bank’s security feature.
Mobile Phone Number
Real-time Authorization: The fake site prompts the victim to confirm a notification in their official CMB app or enter an SMS code. This allows the attacker to authorize a fraudulent wire transfer or register a new “Trusted Device” to the account instantly.

Red Flags to Watch For

The Deceptive URL: The official domain is cmb.fr. Phishing sites use addresses like votre-compte-cmb.online, securite-cmb-bretagne.net, or free subdomains like cmb-client.web.app.
Virtual Keyboard Glitches: While the fake site mimics the official numeric keypad, it may load slowly or fail to respond correctly to clicks, as it is capturing your input in real-time.
Unsolicited SMS with Links: CMB officially states they will never include a clickable link in an SMS regarding account security or “blocking” access.

Expert Security Tip:

The “Digital Key” Interception
The Method:
This case highlights a Man-in-the-Middle (MitM) attack targeting the French “Clé Digitale” (Digital Key) system. Scammers are not just looking for your password; they are waiting in real-time to intercept your app-based authorization.
The Trap:
When you enter your credentials on this fake page, the attacker simultaneously logs into the actual CMB server. The moment the bank sends a “Push Notification” to your phone to confirm your identity, the phishing site tells you to “Accept the notification on your smartphone to finish synchronization.” By tapping “Confirm,” you are actually authorizing the hacker’s login or a large fraudulent payment.
How to Protect Yourself:
Read Before You Tap: When you receive a confirmation prompt on your smartphone, read the text carefully. If it says “Confirm new device registration” or “Confirm a transfer of X €” while you were just trying to “log in” via a link, REJECT IT immediately.
The “Context” Rule: A digital key notification should only appear if YOU manually accessed the official www.cmb.fr website or opened the official app.
Zero Trust for SMS Links: If an SMS says your account is blocked and provides a link to “unblock” it, it is a scam. Log in directly through your official app to check for any real alerts.

Raiffeisen Bank “Digital Security Update” Phishing
Target: Raiffeisen Bank Customers (Central and Eastern Europe)
Threat Level: Critical (Raiffeisen Identity & Digital Token Theft)
Phishing Method Description
This attack targets users of the Raiffeisen Online Banking and the Digital ID apps. Scammers distribute urgent notifications via SMS (Smishing) or Email, claiming that “New Security Regulations” or a “System Maintenance” requires the user to re-verify their profile to avoid account suspension.
The link leads to a high-fidelity clone of the Raiffeisen “Login” portal. This sophisticated phishing kit is specifically designed to harvest:
Customer ID / Username
PIN / Password
Mobile Phone Number
One-Time Password (OTP) / Push Authorization: The fake site prompts the victim to enter the code from their SMS or confirm a notification in their official Raiffeisen app in real-time. This allows the attacker to authorize a fraudulent transfer or link a new device to the account instantly.
Red Flags to Watch For
The Lookalike URL: The official domains are raiffeisen.at, raiffeisen.ro, etc. Phishing sites use deceptive addresses like raiffeisen-securitate.online, verificare-raiffeisen.net, secure-raiffeisen-login.com, or free subdomains like raiffeisen.web.app.
Urgent & Threatening Tone: Phrases like “Immediate action required” or “Your access will be blocked within 24 hours” are classic social engineering tactics.
Link in SMS/Email: Raiffeisen Bank officially states they will never include a clickable link in an SMS or email that leads directly to a login page asking for your credentials.

Expert Security Tip:

The “Digital ID” Proxy Attack
The Method:
This case highlights a Real-Time Authentication Hijack. Scammers are not just looking for your password; they are acting as a “middleman” between you and the real bank server.
The Trap:
When you enter your credentials on the fake page, the attacker simultaneously enters them on the actual Raiffeisen website. This triggers a legitimate Push Notification or SMS OTP to your phone. The phishing site then asks you to “Confirm the notification to finish the update.” By doing so, you are not securing your account—you are signing a digital signature that authorizes the hacker to drain your funds.
How to Protect Yourself:
The “Context” Rule: Only confirm a notification or enter an OTP if YOU were the one who manually typed the official bank address into your browser. If a prompt appears after clicking a link, REJECT it.
Read the Prompt Carefully: If the notification on your phone says “Authorize a payment” or “Register a new device” but you are just trying to “log in,” it is 100% a scam.
Zero Trust for Links: Raiffeisen will never send you a link to “Log in” or “Update” your security credentials via SMS. Always use the official Raiffeisen Smart Mobile app.

Bankinter Portugal “Security Alert” Phishing
Target: Bankinter Customers in Portugal
Threat Level: Critical (Real-time Account Takeover & SMS OTP Theft)
Phishing Method Description
This attack targets users of Bankinter Particulares (Online Banking). Scammers use a “Fraud Alert” pretext, sending out Smishing (SMS) messages claiming that an “unauthorized access” or “unusual purchase” has been detected. To “cancel” the transaction or “secure” the account, the user is pressured to click a link immediately.
The link leads to a high-fidelity clone of the Bankinter.pt portal. This sophisticated phishing kit is designed to harvest:
User ID / NIF (Número de Identificação Fiscal)
Access Password (Multichannel Key)
Mobile Phone Number
SMS One-Time Password (OTP): The fake site prompts the victim to enter the security code in real-time. The attacker immediately uses this code on the actual Bankinter server to authorize a fraudulent wire transfer or to register their own device as the primary security key.
Red Flags to Watch For
The Lookalike URL: The official domain is bankinter.pt. Phishing sites use deceptive addresses like seguranca-bankinter.online, verificar-acesso-bankinter.net, bankinter-portugal.com, or free subdomains like bankinter-login.web.app.
Urgent & Alarming Tone: Phrases like “Acceso no autorizado detectado” or “Bloqueo preventivo” are used to bypass critical thinking and force an impulsive click.
Link in SMS/Email: Bankinter officially states they will never include a clickable link in an SMS message regarding account security or “blocking” access.

Expert Security Tip:

The “Cancellation” Deception
The Method:
This case highlights a Social Engineering Trick known as the “Cancellation Scam.” Scammers create a fake “security threat” to make you panic.
The Trap:
When you enter an SMS OTP on a fake site to “cancel a fraudulent transaction,” you are actually doing the exact opposite. Because the attacker is logged into your real account in the background, they have just triggered a new fraudulent transfer. The code you just entered is the final digital signature they need to move your money out of the bank.
How to Protect Yourself:
OTP is for Authorization ONLY: A real bank will never ask you to enter an SMS code to cancel or block something. SMS codes are strictly for authorizing actions you started yourself.
The “Manual Entry” Rule: If you receive a security alert via SMS, ignore the link. Open your browser and manually type www.bankinter.pt to log in safely.
Read the SMS Content: Carefully read the text accompanying the code. If it says “Code to authorize a transfer of 1,000 €” but you are trying to “secure your account,” it is 100% a scam.

OTP Bank “Account Access Verification” Phishing
Target: OTP Bank Customers (Hungary, Russia, Romania, Serbia, etc.)
Threat Level: Critical (Real-time OTP Interception & Account Hijacking)

Phishing Method Description
This attack relies on Psychological Pressure. Victims receive a Smishing (SMS) or Email claiming that their “OTPdirekt access has been suspended” or that a “Suspicious login attempt” was detected from a new device.

The link leads to a high-fidelity clone of the OTP Bank login page. This sophisticated phishing kit is designed for a Man-in-the-Middle (MitM) attack, harvesting:

User ID / Account Number (HAZ / ID)
Password / PIN
Mobile Phone Number
Mobile Signature (SMS OTP): The fake site prompts the victim to enter the 6-digit security code received via SMS in real-time. The attacker immediately uses this code on the actual bank site to authorize a fraudulent transfer or link their own device to the account.

Red Flags to Watch For
Deceptive Domain: The official domains are otpbank.hu, otpbank.ru, otpbanka.rs, etc.. Phishing sites use lookalikes such as otpbank-security.online, verific-otp.net, or free subdomains like otp-login.web.app.
Requesting OTP for “Blocking” or “Updates”: A real bank will never ask you for an SMS code to cancel a transaction or unblock an account. Codes are strictly for authorizing actions you started yourself.
Urgent Tone: Messages demanding you “Act within 2 hours” to avoid a total block are clear signs of a scam.

How to Protect Yourself
Use the Mobile App: Manage your security exclusively through the official OTP SmartBank or m-bank app.
The “Manual Entry” Rule: Always type the official address manually into your browser’s address bar. Never click on links in bank messages.
Verify the SMS Source: Official alerts come from registered bank IDs. If a message comes from a standard mobile number, delete it.
Immediate Action: If you have entered data on a suspicious site, call the official OTP Bank support immediately at +36 1 3666 666 (Hungary) or +7 495 783-54-00 (Russia) to freeze your account.

Expert Security Tip:

The “Live Proxy” Hazard
The Method:
This case highlights the Real-Time Token Relay tactic. Scammers use automated kits that act as a “live bridge” between you and the real bank.

The Trap:
When you enter your Mobile Signature SMS code on the fake site, you aren’t “verifying” anything. You are providing the final authorization for a transaction the hacker has already prepared in the background.

How to Protect Yourself:
Read the SMS Content Carefully: If the SMS says “Code to authorize a transfer of X amount” while you are just trying to “log in,” do not enter it.
Switch to Biometric Auth: Use Fingerprint or FaceID inside the official app. These methods are much harder to phish than 6-digit SMS codes.
One-Time Rule: An OTP is meant for one specific action. If the site asks you to enter multiple codes in a row for a single “verification,” close the page—they are draining your account transaction by transaction.