Antiphishing.biz

---

Threat Analysis: Banco BPM Phishing – Multi-Step Credential, Phone Number & OTP Harvesting

This phishing campaign impersonates Banco BPM, one of Italy’s largest banking groups. The scam uses a multi-page flow to capture the victim’s online banking credentials, phone number, and OTP (one-time password) —the two-factor authentication code. By harvesting all three, attackers can bypass security measures and gain full access to the victim’s account.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Credentials Page (First Screenshot)
The first page asks for:

• Codice postazione (Station code) / Identificativo utente (User ID)
• Password

This page captures the victim’s primary online banking credentials.

Step 2 – Fake Phone Number Page (Second Screenshot)
The second page asks for:

• Numero di telefono (Phone number)

This step is designed to capture the victim’s phone number, which is likely used to send the OTP (two-factor authentication code) via SMS. By providing the phone number, the victim enables the attacker to later request and intercept the OTP.

Step 3 – Fake OTP Page (Third Screenshot)
The third page asks for:

• OTP (One-time password)

This is the two-factor authentication code sent to the victim’s phone. When the victim enters this code, the attacker captures it and uses it to complete the login on the real Banco BPM site.

The goal:
The attacker aims to:

• Steal the victim’s Banco BPM online banking credentials (user ID and password)
• Obtain the victim’s phone number (for SIM swapping or to trigger OTP messages)
• Capture the OTP (2FA code) in real time

With all three pieces of information, the attacker can log into the victim’s real bank account and authorize fraudulent transactions.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not bancobpm.it or any official Banco BPM domain. Legitimate Banco BPM online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: Banco BPM does not send emails or messages with links requiring customers to log in and provide this level of information to resolve account issues.
• Multi-step flow with phone number request: Legitimate banking logins do not ask for your phone number on a separate page during the login process. The bank already has your phone number on file.
• Outdated copyright: The footer shows “© 2000-2019,” which is outdated (the screenshots are from 2023). Legitimate bank websites typically display the current year.
• Copied content: The pages include legitimate-looking information about COVID-19 initiatives and YouBusiness Web features, copied from the real Banco BPM website. Attackers use such content to make the pages appear authentic, but its presence does not guarantee legitimacy.
• No personalization: The pages do not address the victim by name or display any account-specific information.

What to do if you encounter this:

• Do not enter your user ID, password, phone number, or OTP on these pages.
• If you are a Banco BPM customer, always access online banking by typing bancobpm.it directly into your browser or by using the official Banco BPM mobile app.
• If you have already entered your credentials and phone number but not the OTP, contact Banco BPM immediately to change your password and secure your account.
• If you have entered the OTP as well, the attacker may have already accessed your account. Contact Banco BPM’s fraud department immediately.
• Report the phishing pages to Banco BPM’s fraud team.

Why this scam is effective:
Banco BPM has millions of customers in Italy. The multi-step flow closely mimics legitimate banking processes where users are sometimes asked for a user ID, password, and then an OTP. The inclusion of real bank content (COVID-19 information, YouBusiness Web features) adds to the illusion of legitimacy. The separate phone number page is a clever tactic: it allows the attacker to collect the victim’s number, which can be used to trigger the real OTP from the bank while the victim waits on the fake page.

Protective measures:

• Bookmark the official Banco BPM login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate bancobpm.it domains, not on phishing sites.
• Never enter your OTP on a page you reached via a link. Legitimate banks only ask for OTP codes after you have initiated a login on their official site.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco BPM domains end with bancobpm.it. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banco BPM directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: HDFC Bank Phishing – Fake NetBanking Login Page

This phishing campaign impersonates HDFC Bank, a major Indian financial institution. The page mimics the bank’s NetBanking login interface to steal customers’ Customer ID/User ID and Password/IPIN (Internet Personal Identification Number).

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake HDFC Bank login page. When the victim enters their Customer ID/User ID and Password/IPIN and clicks “LOGIN,” the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s HDFC Bank online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not hdfcbank.com or any official HDFC Bank domain. Legitimate HDFC NetBanking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: HDFC Bank does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access NetBanking by typing the official URL directly or using the official mobile app.
• Minimal design: While the page includes the HDFC Bank logo and a simple form, it lacks the full navigation, security notices, and personalized elements present on the legitimate NetBanking portal.
• Missing security features: Legitimate HDFC NetBanking pages typically include additional security elements such as a virtual keyboard, security image, or multi-factor authentication steps. This page has only a basic form.
• Generic welcome message: The page includes a generic “Dear Customer” greeting, which is common in phishing pages. Legitimate HDFC NetBanking pages often display a personalized welcome message or security phrase after initial identification.
• No account recovery options: The page lacks links for forgotten Customer ID or Password that would be present on the real login page.

What to do if you encounter this:

• Do not enter your Customer ID, Password/IPIN, or any other personal information on this page.
• If you are an HDFC Bank customer, always access NetBanking by typing hdfcbank.com directly into your browser or by using the official HDFC Bank mobile app.
• If you have already entered your credentials, contact HDFC Bank immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to HDFC Bank’s fraud department (e.g., by forwarding the original message to [email protected] or using their official reporting channels).

Why this scam is effective:
HDFC Bank has tens of millions of NetBanking users in India. The page uses the bank’s logo and a clean, simple design that resembles the real login screen. The request for “Customer ID/User ID” and “Password/IPIN” matches the terminology used by the bank. Many customers are accustomed to logging in through various portals and may not immediately notice that the URL is incorrect.

Protective measures:

• Bookmark the official HDFC NetBanking login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate hdfcbank.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your HDFC Bank account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate HDFC Bank domains end with hdfcbank.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact HDFC Bank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: La Banque Postale Phishing – Fake “Certicode Plus” Security Update Scam

This phishing campaign impersonates La Banque Postale, a major French bank. The message claims that regulatory changes require the victim to accept new conditions and “activate” their Certicode Plus—a legitimate security feature used by the bank for transaction verification. The threat of card suspension is used to pressure the victim into clicking a malicious link.

How it works:
The victim receives this message (likely by email) claiming to be from La Banque Postale. The message:

• States that regulatory changes require the victim to accept new conditions for online card purchases
• Prompts the victim to click a link to “activate” Certicode Plus
• Warns that failure to confirm will result in the suspension of online card purchases and blocking of the card

When the victim clicks the link, they are taken to a phishing page designed to capture their banking credentials, personal information, or Certicode Plus verification codes.

The goal:
The attacker aims to:

• Steal the victim’s La Banque Postale online banking credentials
• Capture Certicode Plus verification codes (two-factor authentication)
• Obtain card details or other personal information

With this information, the attacker can access the victim’s bank account, make unauthorized purchases, and commit fraud.

Red flags to watch for:

• Suspicious link: The message contains a link (disguised as “Active+Votre-Mobile”) that leads to a phishing site. Legitimate La Banque Postale communications do not require customers to click links to activate security features.
• Threat of suspension: The warning that the card will be blocked if no action is taken is a classic fear-based tactic to pressure victims into acting without thinking.
• Unsolicited request: La Banque Postale does not send emails with links requiring customers to “accept new regulations” or “activate” Certicode Plus via external links. Legitimate security features are activated within the app or after logging into the official website.
• Generic greeting: The message does not address the victim by name or reference a specific account number—common in phishing emails.
• Vague regulatory reference: The message refers vaguely to “regulatory changes” without specifics, a common phishing tactic.
• Poor formatting: While the design mimics La Banque Postale’s branding, the layout and language contain stylistic inconsistencies compared to official communications.

What to do if you encounter this:

• Do not click any link in the message.
• Do not enter any personal information, banking credentials, or Certicode Plus codes on any page reached via this link.
• If you are a La Banque Postale customer, always access online banking by typing labanquepostale.fr directly into your browser or by using the official mobile app.
• If you have already clicked the link and entered any information, contact La Banque Postale immediately through their official customer service hotline to secure your account.
• Report the phishing email to La Banque Postale’s fraud department (e.g., by forwarding it to [email protected] or using their official reporting channel).

Why this scam is effective:
La Banque Postale has millions of customers in France. Certicode Plus is a real security feature used by the bank for transaction verification, so references to it are familiar and appear legitimate. The threat of card suspension creates urgency, prompting victims to click the link without carefully checking its destination. The message’s design and language closely mimic official bank communications.

Protective measures:

• Never click links in unsolicited emails or messages claiming to be from your bank. Instead, type the official bank URL directly into your browser.
• Be suspicious of any message that creates urgency, threatens consequences (such as card suspension), and asks you to click a link to “activate” or “verify” something.
• Check the sender’s email address carefully. Legitimate La Banque Postale emails come from @labanquepostale.fr or specific subdomains—not from generic or misspelled addresses.
• Enable Certicode Plus through the official app if you haven’t already, and remember that legitimate activation processes happen within the app or after logging into the official website—not via a link in an email.
• If in doubt, contact La Banque Postale directly using a phone number from your bank statement or the official website—never use contact information provided in the suspicious message.

---

Thank you for sharing these four screenshots. They show a multi-step phishing campaign impersonating Nickel, a French neobank (a subsidiary of BNP Paribas) that offers fee-based bank accounts typically sold in tobacco shops. The scam is designed to capture the victim’s identifier, access code, SMS verification code, and full card details—enabling full account takeover and card fraud. Here is a detailed English description that avoids exact quotes from the screenshot content to minimize antivirus false positives.

---

Threat Analysis: Nickel Phishing – Multi-Step Credential, SMS Code & Card Data Harvesting

This phishing campaign impersonates Nickel, a French neobank popular for its accessible accounts. The scam uses a multi-page flow to capture the victim’s identifier, access code, SMS verification code, and full card details (card number, expiration date, CVV). By harvesting all of this information, attackers can gain full access to the victim’s account and use the card for fraudulent transactions.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Login Page (Identifier Entry)
The first page asks for the victim’s identifier (which, according to the page, is found on the back of the physical Nickel card). It also includes a “Remember me” checkbox and options for first-time connection or card opposition.

Step 2 – Fake Access Code Page with Virtual Keyboard
The second page asks for:

• Identifier (pre-filled or re-entered)
• Access code (a numeric PIN) using a virtual keyboard

The virtual keyboard is a common security feature in French banking, used to protect against keyloggers. Its presence here is intended to make the page appear legitimate.

Step 3 – Fake SMS Code Page
The third page asks for the SMS code sent to the victim’s mobile phone. This is the two-factor authentication (2FA) code used to verify the login.

Step 4 – Fake Card Details Page
The fourth page requests full card details.

This page is designed to capture all the information needed to use the victim’s card for online purchases or to clone the card.

The goal:
The attacker aims to:

• Steal the victim’s Nickel account credentials (identifier and access code)
• Intercept the SMS verification code (2FA)
• Obtain full card details (number, expiration, CVV)

With this combination, the attacker can:

• Log into the victim’s Nickel account
• Make online purchases using the card details
• Potentially withdraw funds or transfer money
• Commit identity theft using the victim’s personal information

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not nickel.eu or any official Nickel domain. Legitimate Nickel online access is through the official website or app. Always check the address bar.
• Multiple sensitive data requests: A legitimate login process would not ask for identifier, access code, SMS code, and full card details in sequence. This combination is a clear sign of a phishing kit.
• Unsolicited login request: Nickel does not send emails or messages with links requiring customers to log in and provide this level of information to resolve account issues.
• Card details page after login: After successfully entering credentials and SMS code, a legitimate bank would not ask for full card details. This is a phishing page designed to capture card data after the victim believes they are already logged in.
• Virtual keyboard: While real Nickel uses a virtual keyboard for security, phishing pages often replicate this feature to appear legitimate. Its presence alone does not guarantee safety.
• Generic design: The pages mimic Nickel’s branding but lack the full account-specific information that would appear on a legitimate logged-in session.

What to do if you encounter this:

• Do not enter your identifier, access code, SMS code, or card details on these pages.
• If you are a Nickel customer, always access your account by typing nickel.eu directly into your browser or by using the official Nickel mobile app.
• If you have already entered your credentials and SMS code but not card details, contact Nickel immediately to change your credentials and secure your account. Assume the attacker may have already accessed your account.
• If you have entered your card details, contact Nickel’s fraud department immediately to block your card and dispute any unauthorized transactions.
• Report the phishing pages to Nickel’s fraud team.

Why this scam is particularly dangerous:
This is a complete account takeover and card fraud phishing kit. The multi-step flow closely mimics legitimate banking processes (identifier, access code, SMS verification), making it highly convincing. The final request for card details is especially dangerous because victims may believe they need to “re-enter” their card information after a security update. The virtual keyboard adds an extra layer of perceived legitimacy.

Protective measures:

• Bookmark the official Nickel login page and use that bookmark to access your account—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate nickel.eu domains, not on phishing sites.
• Never enter your SMS verification code on a page you reached via a link. Legitimate banks only ask for 2FA codes after you have initiated a login on their official site.
• Never enter your full card details (CVV included) after logging in. This is not a standard banking practice.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Nickel domains end with nickel.eu. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Nickel directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Banco G&T Continental Phishing – Credential & SMS Token Harvesting

This phishing campaign impersonates Banco G&T Continental, one of the largest banks in Guatemala. The scam uses a multi-page flow to capture the victim’s online banking credentials and then the SMS token (two-factor authentication code) , allowing attackers to bypass security measures and gain full access to the account.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Login Page (First Screenshot)
The first page asks for:

• Usuario (username)
• Contraseña (password)

This page captures the victim’s primary online banking credentials.

Step 2 – Fake Loading/Waiting Page (Second Screenshot)
The second page displays a fake loading message, stating that the victim’s credentials are being verified. A countdown timer (20 seconds) creates a sense of legitimate processing while the attacker, in the background, uses the stolen credentials to log into the real bank site and trigger an SMS token to the victim’s phone.

Step 3 – Fake SMS Token Page (Third Screenshot)
The third page asks for the SMS token (the two-factor authentication code sent to the victim’s mobile phone). When the victim enters this code, the attacker captures it and uses it to complete the login on the real Banco G&T Continental site.

The goal:
The attacker aims to:

• Steal the victim’s online banking credentials (usuario and contraseña)
• Capture the SMS token (2FA code) in real time
• Gain full access to the victim’s bank account to transfer funds, pay bills, and commit fraud

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not gyb.com.gt or any official Banco G&T Continental domain. Legitimate online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: Banco G&T Continental does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Fake loading page with countdown: Legitimate banking sites do not display artificial loading countdown timers during login. This is a classic phishing tactic to buy time for the attacker to use the stolen credentials on the real site.
• Multi-step design with SMS token request: After entering credentials, the victim is asked for the SMS token. This mirrors the real 2FA flow, making it convincing, but the pages are fake.
• No personalization or security image: Legitimate Banco G&T Continental login pages may display a security image or personalized greeting. These pages lack such features.
• Outdated copyright: The footer shows “2022” (the screenshots are from 2023). While not a definitive red flag, outdated copyright notices are common in phishing pages.

What to do if you encounter this:

• Do not enter your usuario, contraseña, or SMS token on these pages.
• If you are a Banco G&T Continental customer, always access online banking by typing gyb.com.gt directly into your browser or by using the official mobile app.
• If you have already entered your credentials but not the SMS token, contact Banco G&T Continental immediately to change your password and secure your account.
• If you have entered the SMS token as well, the attacker may have already accessed your account. Contact the bank’s fraud department immediately.
• Report the phishing pages to Banco G&T Continental’s fraud team.

Why this scam is particularly dangerous:
This is a real-time account takeover phishing kit. The attacker uses the stolen username and password immediately to log into the real bank site and trigger an SMS token. The fake loading page buys time for this process. When the victim enters the SMS token on the phishing page, the attacker uses it to complete the login—often within seconds. By the time the victim realizes something is wrong, the attacker may have already transferred funds.

Protective measures:

• Bookmark the official Banco G&T Continental login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate gyb.com.gt domains, not on phishing sites.
• Never enter your SMS token on a page you reached via a link. Legitimate banks only ask for 2FA codes after you have initiated a login on their official site.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco G&T Continental domains end with gyb.com.gt. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banco G&T Continental directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Banco Galicia Phishing – Fake “Acceso” Login Page

This phishing campaign impersonates Banco Galicia, one of the largest banks in Argentina. The page mimics the bank’s login interface to steal customers’ DNI (national identification number), Usuario Galicia (username), and Clave Galicia (password) —the three pieces of information typically required to access online banking.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Banco Galicia login page. When the victim enters their DNI, Usuario, and Clave and clicks “INICIAR SESIÓN” (the button is truncated but means “Log in”), the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s Banco Galicia online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not banco-galicia.com.ar or any official Banco Galicia domain. Legitimate Banco Galicia online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: Banco Galicia does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Missing security features: Legitimate Banco Galicia login pages typically include a virtual keyboard (which is mentioned but may not function) and a security image or personalized greeting. This page lacks the full security implementation.
• Typographical error: The login button reads “INICIAR SESI” (missing the final “ÓN”), which is likely a truncation error in the phishing page design. Official bank interfaces do not have such truncations.
• Poor grammar and truncated text: The text below the form is garbled and incomplete (“Olvidé o bloqueé n°1” followed by nonsensical Spanish). This is a clear indicator of a hastily assembled phishing page.
• Generic design: While the page uses the Banco Galicia logo and a simple form, it lacks the full navigation, account-specific information, and professional polish of the real bank website.

What to do if you encounter this:

• Do not enter your DNI, Usuario, Clave, or any other personal information on this page.
• If you are a Banco Galicia customer, always access online banking by typing banco-galicia.com.ar directly into your browser or by using the official Banco Galicia mobile app.
• If you have already entered your credentials, contact Banco Galicia immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Banco Galicia’s fraud department.

Why this scam is effective:
Banco Galicia has millions of online banking customers in Argentina. The page uses the bank’s logo and familiar terminology (“DNI,” “Usuario Galicia,” “Clave Galicia”), which are standard for the bank’s login process. The mention of a virtual keyboard (a real security feature used by the bank) adds a layer of perceived legitimacy. However, the truncation errors and garbled text are red flags that attentive users might notice.

Protective measures:

• Bookmark the official Banco Galicia login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate banco-galicia.com.ar domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your Banco Galicia account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco Galicia domains end with banco-galicia.com.ar. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banco Galicia directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Nickel Phishing – Fake “Sponsorship” Offer Stealing Card Details

This phishing campaign impersonates Nickel, a French neobank (a subsidiary of BNP Paribas). The scam uses a fake “parrainage” (referral/sponsorship) offer to lure victims into providing their personal information and full card details under the guise of participating in a rewards program.

How it works:
The victim encounters this page via a phishing email, SMS, social media post, or other message promoting a lucrative “sponsorship” offer from Nickel. The page claims to offer a reward for referring a friend. To participate, the victim is asked to enter:

• First name and last name
• Email address
• Cardholder name
• Full card number
• Expiration date (MM/YY)

The goal:
The attacker aims to:

• Steal the victim’s full card details (card number, cardholder name, expiration date)
• Obtain the victim’s email address and full name for identity theft or further attacks

With the card details, the attacker can make unauthorized online purchases, create cloned cards, or sell the information on criminal marketplaces.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not nickel.eu or any official Nickel domain. The presence of “WIX.com” website builder branding at the top indicates this is a cheap, quickly created phishing page, not an official bank site.
• Request for full card details for a sponsorship program: A legitimate referral program would never require the participant’s full card number and expiration date. This is a clear indicator of a phishing attempt.
• Too good to be true offer: Fake “sponsorship” or “referral” offers are commonly used to trick victims into providing personal information under the promise of easy rewards.
• Missing security features: The page lacks any of the security indicators expected on a legitimate banking site (SSL certificate details, official domain, padlock icon in the address bar).
• Unprofessional design: The page is extremely simple and lacks the full branding, navigation, and legal information that would appear on the legitimate Nickel website.
• No account login required: A legitimate referral program would require the user to log into their existing Nickel account—not enter card details directly on a promotional page.

What to do if you encounter this:

• Do not enter your name, email address, card number, expiration date, or any other personal information on this page.
• If you are a Nickel customer, always access official promotions and your account by typing nickel.eu directly into your browser or by using the official Nickel mobile app.
• If you have already entered your card details, contact Nickel immediately through their official customer service hotline to block your card and dispute any unauthorized transactions.
• Report the phishing page to Nickel’s fraud department.

Why this scam is effective:
Nickel accounts are often used by individuals who appreciate the simplicity and accessibility of the service. “Parrainage” (referral) programs are common in French banking and often offer real rewards, so users may be familiar with the concept. The promise of an easy reward can prompt users to enter information without carefully scrutinizing the URL or the legitimacy of the page. The request for card details may not raise immediate suspicion if the victim believes it’s required to “verify” their account for the reward.

Protective measures:

• Always type the official bank URL directly into your browser—never click links in emails or messages claiming to offer rewards or promotions.
• Never enter your full card number, expiration date, or CVV in response to a promotional offer. Legitimate banks do not require this information for referral programs.
• Be suspicious of any unsolicited message that offers easy rewards in exchange for personal information.
• Check the URL carefully: Legitimate Nickel domains end with nickel.eu. Look for misspellings, extra words, or unusual top-level domains. Also be wary of pages hosted on free website builders like WIX, Weebly, or similar platforms.
• If in doubt, contact Nickel directly using a phone number from your bank statement or the official website—never use contact information provided in the suspicious message.

---

---

Threat Analysis: Naranja X Phishing – Fake Login Page Stealing Email and Password

This phishing campaign impersonates Naranja X, a popular digital financial platform in Argentina that offers credit cards, loans, and digital accounts. The page mimics the platform’s login interface to steal customers’ email address and password.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Naranja X login page. When the victim enters their email and password and clicks “Iniciar sesión” (Log in), the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s Naranja X account credentials. With these, they can:

• Log into the victim’s Naranja X account
• Access linked credit cards and financial services
• Make unauthorized purchases or transfers
• Obtain personal information for identity theft

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not naranjax.com.ar or any official Naranja X domain. Legitimate Naranja X online access is through the bank’s official website or mobile app. Always check the address bar.
• Unsolicited login request: Naranja X does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access their accounts by typing the official URL directly or using the official app.
• Minimal design: While the page includes the Naranja X logo, it lacks the full branding, navigation menus, security notices, and personalized elements present on the legitimate login page.
• Missing security features: Legitimate Naranja X login pages typically include additional security elements such as a virtual keyboard, CAPTCHA, or multi-factor authentication prompts. This page has only a basic form.
• Generic form: The page asks only for email and password without any account-specific personalization or security verification.

What to do if you encounter this:

• Do not enter your email, password, or any other personal information on this page.
• If you are a Naranja X customer, always access your account by typing naranjax.com.ar directly into your browser or by using the official Naranja X mobile app.
• If you have already entered your credentials, contact Naranja X immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Naranja X’s fraud department.

Why this scam is effective:
Naranja X has millions of users in Argentina, and its digital-first approach means many customers are accustomed to logging in via email and password. The page uses the brand’s recognizable logo and simple, clean design. The straightforward login form mirrors the actual Naranja X interface, making it easy for a distracted user to enter credentials without checking the URL.

Protective measures:

• Bookmark the official Naranja X login page and use that bookmark to access your account—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate naranjax.com.ar domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your Naranja X account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your account.
• Check the URL carefully: Legitimate Naranja X domains end with naranjax.com.ar. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Naranja X directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

Threat Analysis: Daviplata Phishing – Credential & SMS Code Harvesting

This phishing campaign impersonates Daviplata, a widely used digital wallet and mobile payment platform in Colombia, operated by Davivienda Bank. The scam uses a multi-page flow to capture the victim’s document number, Daviplata password, and the SMS verification code—the three elements needed to access the account and authorize transactions.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Login Page (First Screenshot)
The first page asks for:

• Número de documento (Document number – typically the Colombian national ID, “cédula”)
• Clave Daviplata (Daviplata password)

This page captures the victim’s primary account credentials.

Step 2 – Fake Waiting/Loading Page (Second Screenshot)
The second page displays a fake loading message with a countdown timer (23 seconds), claiming that a code is being sent to the victim’s phone. This page serves two purposes:

• It creates a sense of legitimate processing
• It buys time for the attacker to use the stolen credentials to log into the real Daviplata platform and trigger an SMS code to the victim’s phone

Step 3 – Fake SMS Code Page (Third Screenshot)
The third page asks for the SMS verification code sent to the victim’s mobile phone. When the victim enters this code, the attacker captures it and uses it to complete the login on the real Daviplata platform.

The goal:
The attacker aims to:

• Steal the victim’s Daviplata credentials (document number and password)
• Capture the SMS verification code (2FA) in real time
• Gain full access to the victim’s Daviplata account to transfer funds, make payments, and commit fraud

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not daviplata.com or any official Davivienda/Daviplata domain. Legitimate Daviplata access is through the official mobile app or website. Always check the address bar.
• Unsolicited login request: Daviplata does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access their accounts by opening the official app or typing the official URL directly.
• Fake loading page with countdown: Legitimate banking apps and platforms do not display artificial countdown timers during login. This is a classic phishing tactic to buy time for the attacker to use stolen credentials on the real site.
• Multi-step design with SMS code request: After entering credentials, the victim is asked for an SMS code. This mirrors the real 2FA flow, making it convincing, but the pages are fake.
• Minimal design: The pages lack the full branding, security notices, and personalized elements present on the legitimate Daviplata interface.

What to do if you encounter this:

• Do not enter your document number, password, or SMS verification code on these pages.
• If you are a Daviplata user, always access your account by opening the official Daviplata mobile app or by typing the official website URL directly into your browser.
• If you have already entered your credentials but not the SMS code, change your Daviplata password immediately and contact Davivienda’s customer service to secure your account.
• If you have entered the SMS code as well, the attacker may have already accessed your account. Contact Davivienda’s fraud department immediately to block your account and reverse any unauthorized transactions.
• Report the phishing pages to Davivienda’s fraud team.

Why this scam is particularly dangerous:
This is a real-time account takeover phishing kit. The attacker uses the stolen document number and password immediately to log into the real Daviplata platform and trigger an SMS code. The fake loading page buys time for this process. When the victim enters the SMS code on the phishing page, the attacker uses it to complete the login—often within seconds. Daviplata is a popular digital wallet in Colombia, and many users keep significant balances or link their accounts to bank cards, making successful attacks financially damaging.

Protective measures:

• Always access Daviplata through the official mobile app or by typing the official website URL directly—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate domains, not on phishing sites.
• Never enter your SMS verification code on a page you reached via a link. Legitimate platforms only ask for 2FA codes after you have initiated a login on their official app or website.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your account.
• Check the URL carefully: Legitimate Daviplata domains are associated with daviplata.com and davivienda.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Davivienda directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---