Antiphishing.biz

Then user will be redirected to the truth Scotiabank’s Website:

---

Threat Analysis: Scotiabank Phishing – Multi-Step Credential & Email Harvesting with Real Bank Redirection

This sophisticated phishing campaign impersonates Scotiabank, targeting Spanish-speaking customers (likely in Latin America). The attack uses a multi-page flow to capture the victim’s bank login credentials (document number and password) and email account credentials. After capturing this information, the victim is redirected to the real Scotiabank website, making the attack harder to detect.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Bank Login Page (First Screenshot)
The first page asks for:

• Document type (pre-selected as DNI – national ID)
• Document number
• Password

This page captures the victim’s primary banking credentials.

Step 2 – Fake Email Credentials Page (Second Screenshot)
The second page asks for:

• Email address
• Email password

This step captures the victim’s email account credentials, which can be used to intercept bank communications, reset passwords, and maintain persistent access.

Step 3 – Redirect to Genuine Scotiabank Dashboard (Third Screenshot)
After the victim submits their email credentials, they are redirected to the real Scotiabank online banking dashboard. The victim sees their actual accounts and balances, believing their login was successful and that nothing suspicious occurred. In reality, the attacker has already captured the credentials on the preceding fake pages.

The goal:
The attacker aims to:

• Steal the victim’s Scotiabank online banking credentials
• Capture the victim’s email address and password
• Gain full access to both the bank account and email account

With email access, the attacker can intercept password reset emails, delete fraud alerts, and maintain long-term access. The redirection to the real bank site reduces the likelihood that the victim will immediately realize they have been scammed, giving the attacker more time to exploit the stolen credentials.

Red flags to watch for:

• Suspicious URL: The first two pages are hosted on domains that are not official Scotiabank domains. Victims should carefully check the address bar before entering any credentials. The redirection to the real site happens after the credentials are stolen.
• Request for email password: No legitimate bank asks for your email account password. This is a clear indicator of a phishing attack designed to take over your email as well.
• Multi-step flow with unrelated requests: Banking login and email credentials are never requested together in a legitimate banking session.
• Unsolicited login request: Scotiabank does not send emails or messages with links requiring customers to log in to resolve account issues.
• Typographical error: The first page contains a minor typo (“Ingresa tu número de docur” instead of “documento”), which is uncommon in official bank communications.

What to do if you encounter this:

• Do not enter your document number, bank password, email address, or email password on pages reached via unsolicited links—even if you are later redirected to what looks like the real bank site.
• If you are a Scotiabank customer, always access online banking by typing the official Scotiabank URL for your country directly into your browser or by using the official mobile app.
• If you have already entered your email credentials, change your email password immediately, enable two-factor authentication on your email account, and check for any unauthorized forwarding rules or account changes.
• If you have entered your banking credentials, contact Scotiabank immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing pages to Scotiabank’s fraud department.

Why this scam is particularly dangerous:
This is a sophisticated phishing technique that combines credential theft with a redirection to the legitimate site. Victims often assume that because they ended up on the real bank website after logging in, the first pages must have been legitimate. The email credential harvesting gives attackers persistent access to the victim’s communications, enabling them to intercept fraud alerts and maintain control even if the victim later changes their bank password.

Protective measures:

• Always initiate banking sessions by typing the official URL directly—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate Scotiabank domains, not on phishing sites.
• Never enter your email password on any page that claims to be your bank. Legitimate banks never ask for this.
• Enable two-factor authentication (2FA) on both your bank account and email account, using an authenticator app rather than SMS where possible.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully before entering credentials: Legitimate Scotiabank domains vary by country (e.g., scotiabank.com.mx for Mexico, scotiabank.com.pe for Peru, scotiabank.cl for Chile). Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Scotiabank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Global Bank Phishing – Fake “Token” Verification & 2FA Code Harvesting

This phishing campaign impersonates Global Bank, a financial institution operating in Panama and other Central American countries. The scam is designed to capture the victim’s dynamic password (token) —the one-time two-factor authentication (2FA) code used to authorize transactions and logins. This code is the final layer of security; by stealing it, attackers can bypass the bank’s primary defenses.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page. The attack likely occurs after the victim has already entered their primary credentials (username and password) on a previous phishing page (not shown in these screenshots).

Step 1 – Fake Global Bank Landing/Information Page
The first and second screenshots show pages with Global Bank branding, navigation menus, and footer content copied from the legitimate bank website. These pages serve as a “lobby” or informational area, likely intended to make the phishing site appear legitimate before the victim proceeds to the token entry page.

Step 2 – Fake Loading Page
The third screenshot shows a fake loading page with a countdown timer (“0:27”). This page is designed to create a sense of legitimate processing while the attacker prepares to capture the token code.

Step 3 – Fake Token Validation Page
The fourth screenshot shows a page asking for the victim’s dynamic password (token) —the one-time 2FA code. This is the critical security code used to authorize access or transactions.

Step 4 – Fake Error Page (Token Invalido)
The fifth screenshot shows a fake error page stating that the token entered was invalid. This page is designed to trick the victim into entering the token again, either because they made a typo or because the attacker needs more time to use the first code. The error message creates urgency and encourages the victim to re-enter the code.

The goal:
The attacker aims to:

• Capture the victim’s dynamic token (2FA code) in real time
• Use this code to log into the victim’s real bank account or authorize fraudulent transactions
• The fake error page serves to obtain a second token if the first one expires or if the attacker needs additional codes

With the primary credentials (captured on an earlier page) and the token, the attacker can gain full access to the victim’s bank account.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not the official Global Bank domain. Legitimate Global Bank online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: Global Bank does not send emails or messages with links requiring customers to log in and enter token codes to resolve account issues.
• Fake loading page: Legitimate banking sites do not display artificial loading countdown timers before asking for a token. This is a tactic to create anticipation and make the phishing site feel “technical.”
• Fake error page: The error page claiming “Token Invalido” is a classic phishing technique to get victims to enter the code again. In reality, the first code may have already been used by the attacker.
• Outdated copyright: The footer shows “© 2014 Global Bank,” which is outdated (the screenshots are from 2023). Legitimate bank websites typically display the current year.
• Minimal design on token pages: The token validation pages lack the full navigation, account-specific information, and personalization that would appear on a legitimate logged-in session.

What to do if you encounter this:

• Do not enter your dynamic password (token) or any other codes on these pages.
• If you are a Global Bank customer, always access online banking by typing the official Global Bank URL directly into your browser or by using the official mobile app.
• If you have already entered your token code, contact Global Bank immediately through their official customer service hotline to secure your account. The attacker may have already used the code to log in.
• Report the phishing pages to Global Bank’s fraud department.

Why this scam is particularly dangerous:
This attack targets the two-factor authentication (2FA) code—often the last line of defense for online banking accounts. By capturing both the primary credentials (on earlier pages) and the token (on these pages), the attacker can bypass security measures and gain full account access. The fake error page is a sophisticated touch: if the first token expires or is used by the attacker, the victim may enter a second one, giving the attacker even more access.

Protective measures:

• Bookmark the official Global Bank login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate bank domains, not on phishing sites.
• Never enter your token or 2FA code on a page you reached via a link. Legitimate banks only ask for these codes after you have initiated a login or transaction on their official site.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Global Bank domains are associated with the bank’s official website. Look for misspellings, extra words, or unusual top-level domains.
• If you see a fake error page after entering a token, assume your credentials are compromised. Contact your bank immediately.
• If in doubt, contact Global Bank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Crédit Agricole Phishing – Fake “SecuriPass” Security Update Scam

This phishing campaign impersonates Crédit Agricole, one of the largest banking groups in France. The page claims that security updates have been made and urges the victim to click a link to “reinforce” their SecuriPass (the bank’s real security feature). The page outlines a multi-step process involving SMS and email codes, followed by card reactivation—all designed to lead the victim through a series of phishing pages that capture sensitive information.

How it works:
The victim receives a phishing email (or lands on this page via a link in a message) claiming to be from Crédit Agricole. The page:

• States that new security updates have been implemented
• Claims the victim must access their client space via a provided link to reinforce SecuriPass
• Outlines three steps: entering a 6-digit SMS code, waiting for a 6-digit email code, and reactivating their bank card
• Warns that ignoring the activation will result in a banking restriction

When the victim clicks the link (likely embedded in the text), they are taken to a fake Crédit Agricole login page or a series of pages designed to capture their credentials, SMS codes, email codes, and card details.

The goal:
The attacker aims to:

• Steal the victim’s Crédit Agricole online banking credentials
• Capture SMS-based two-factor authentication (2FA) codes
• Capture email-based verification codes
• Obtain bank card details (through the fake “reactivation” step)

With this combination of information, the attacker can gain full access to the victim’s bank account, authorize transactions, and potentially compromise the victim’s email account as well.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not credit-agricole.fr or any official Crédit Agricole domain. Legitimate bank communications are hosted on official domains. Always check the address bar.
• Unsolicited security request: Crédit Agricole does not send emails or messages with links requiring customers to click to “reinforce” security features. Legitimate security updates are communicated through official app notifications or secure messages within the online banking portal.
• Multi-step code requests: The page mentions receiving two separate codes (SMS and email) and then reactivating a card. This is highly unusual for a legitimate security update and indicates a phishing kit designed to harvest multiple layers of authentication.
• Threat of consequences: The warning that ignoring the activation will result in a “banking restriction” is a classic fear-based tactic to pressure victims into acting without thinking.
• Generic greeting: The page does not address the victim by name or reference a specific account number—common in phishing messages.
• Poor formatting: While the design mimics Crédit Agricole’s branding, the overall layout and language contain stylistic inconsistencies compared to official communications.

What to do if you encounter this:

• Do not click any link in the message or on this page.
• Do not enter any personal information, credentials, SMS codes, or card details on any pages reached via this link.
• If you are a Crédit Agricole customer, always access online banking by typing credit-agricole.fr directly into your browser or by using the official Crédit Agricole mobile app.
• If you have already clicked the link and entered any information, contact Crédit Agricole immediately through their official customer service hotline to secure your account.
• Report the phishing page to Crédit Agricole’s fraud department (e.g., by forwarding the original message to [email protected] or using their official reporting channel).

Why this scam is effective:
Crédit Agricole has millions of online banking customers in France. The mention of SecuriPass—a real security feature—makes the page seem credible. The multi-step instructions (SMS code, email code, card reactivation) make the process appear thorough and “official.” The threat of a banking restriction creates urgency, encouraging victims to act quickly without scrutinizing the URL or the legitimacy of the message.

Protective measures:

• Never click links in unsolicited emails or messages claiming to be from your bank. Instead, type the official bank URL directly into your browser.
• Be suspicious of any message that creates urgency, threatens consequences, and asks you to click a link to “activate,” “reinforce,” or “verify” something.
• Check the sender’s email address carefully. Legitimate Crédit Agricole emails come from @credit-agricole.fr or specific subdomains—not from generic or misspelled addresses.
• Enable two-factor authentication (SecuriPass) through the official app, and remember that legitimate activation processes happen within the app or after logging into the official website—not via a link in an email.
• If you receive a request to enter codes from both SMS and email, be extremely suspicious. Legitimate banks do not use multi-step code harvesting in this manner.
• If in doubt, contact your bank directly using a phone number from your bank statement or the official website—never use contact information provided in the suspicious message.

---

---

Threat Analysis: Banco BPM Phishing – Multi-Step Credential, Phone Number & OTP Harvesting

This phishing campaign impersonates Banco BPM, one of Italy’s largest banking groups. The scam uses a multi-page flow to capture the victim’s online banking credentials, phone number, and OTP (one-time password) —the two-factor authentication code. By harvesting all three, attackers can bypass security measures and gain full access to the victim’s account.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Credentials Page (First Screenshot)
The first page asks for:

• Codice postazione (Station code) / Identificativo utente (User ID)
• Password

This page captures the victim’s primary online banking credentials.

Step 2 – Fake Phone Number Page (Second Screenshot)
The second page asks for:

• Numero di telefono (Phone number)

This step is designed to capture the victim’s phone number, which is likely used to send the OTP (two-factor authentication code) via SMS. By providing the phone number, the victim enables the attacker to later request and intercept the OTP.

Step 3 – Fake OTP Page (Third Screenshot)
The third page asks for:

• OTP (One-time password)

This is the two-factor authentication code sent to the victim’s phone. When the victim enters this code, the attacker captures it and uses it to complete the login on the real Banco BPM site.

The goal:
The attacker aims to:

• Steal the victim’s Banco BPM online banking credentials (user ID and password)
• Obtain the victim’s phone number (for SIM swapping or to trigger OTP messages)
• Capture the OTP (2FA code) in real time

With all three pieces of information, the attacker can log into the victim’s real bank account and authorize fraudulent transactions.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not bancobpm.it or any official Banco BPM domain. Legitimate Banco BPM online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: Banco BPM does not send emails or messages with links requiring customers to log in and provide this level of information to resolve account issues.
• Multi-step flow with phone number request: Legitimate banking logins do not ask for your phone number on a separate page during the login process. The bank already has your phone number on file.
• Outdated copyright: The footer shows “© 2000-2019,” which is outdated (the screenshots are from 2023). Legitimate bank websites typically display the current year.
• Copied content: The pages include legitimate-looking information about COVID-19 initiatives and YouBusiness Web features, copied from the real Banco BPM website. Attackers use such content to make the pages appear authentic, but its presence does not guarantee legitimacy.
• No personalization: The pages do not address the victim by name or display any account-specific information.

What to do if you encounter this:

• Do not enter your user ID, password, phone number, or OTP on these pages.
• If you are a Banco BPM customer, always access online banking by typing bancobpm.it directly into your browser or by using the official Banco BPM mobile app.
• If you have already entered your credentials and phone number but not the OTP, contact Banco BPM immediately to change your password and secure your account.
• If you have entered the OTP as well, the attacker may have already accessed your account. Contact Banco BPM’s fraud department immediately.
• Report the phishing pages to Banco BPM’s fraud team.

Why this scam is effective:
Banco BPM has millions of customers in Italy. The multi-step flow closely mimics legitimate banking processes where users are sometimes asked for a user ID, password, and then an OTP. The inclusion of real bank content (COVID-19 information, YouBusiness Web features) adds to the illusion of legitimacy. The separate phone number page is a clever tactic: it allows the attacker to collect the victim’s number, which can be used to trigger the real OTP from the bank while the victim waits on the fake page.

Protective measures:

• Bookmark the official Banco BPM login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate bancobpm.it domains, not on phishing sites.
• Never enter your OTP on a page you reached via a link. Legitimate banks only ask for OTP codes after you have initiated a login on their official site.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco BPM domains end with bancobpm.it. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banco BPM directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: HDFC Bank Phishing – Fake NetBanking Login Page

This phishing campaign impersonates HDFC Bank, a major Indian financial institution. The page mimics the bank’s NetBanking login interface to steal customers’ Customer ID/User ID and Password/IPIN (Internet Personal Identification Number).

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake HDFC Bank login page. When the victim enters their Customer ID/User ID and Password/IPIN and clicks “LOGIN,” the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s HDFC Bank online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not hdfcbank.com or any official HDFC Bank domain. Legitimate HDFC NetBanking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: HDFC Bank does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access NetBanking by typing the official URL directly or using the official mobile app.
• Minimal design: While the page includes the HDFC Bank logo and a simple form, it lacks the full navigation, security notices, and personalized elements present on the legitimate NetBanking portal.
• Missing security features: Legitimate HDFC NetBanking pages typically include additional security elements such as a virtual keyboard, security image, or multi-factor authentication steps. This page has only a basic form.
• Generic welcome message: The page includes a generic “Dear Customer” greeting, which is common in phishing pages. Legitimate HDFC NetBanking pages often display a personalized welcome message or security phrase after initial identification.
• No account recovery options: The page lacks links for forgotten Customer ID or Password that would be present on the real login page.

What to do if you encounter this:

• Do not enter your Customer ID, Password/IPIN, or any other personal information on this page.
• If you are an HDFC Bank customer, always access NetBanking by typing hdfcbank.com directly into your browser or by using the official HDFC Bank mobile app.
• If you have already entered your credentials, contact HDFC Bank immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to HDFC Bank’s fraud department (e.g., by forwarding the original message to [email protected] or using their official reporting channels).

Why this scam is effective:
HDFC Bank has tens of millions of NetBanking users in India. The page uses the bank’s logo and a clean, simple design that resembles the real login screen. The request for “Customer ID/User ID” and “Password/IPIN” matches the terminology used by the bank. Many customers are accustomed to logging in through various portals and may not immediately notice that the URL is incorrect.

Protective measures:

• Bookmark the official HDFC NetBanking login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate hdfcbank.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your HDFC Bank account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate HDFC Bank domains end with hdfcbank.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact HDFC Bank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: La Banque Postale Phishing – Fake “Certicode Plus” Security Update Scam

This phishing campaign impersonates La Banque Postale, a major French bank. The message claims that regulatory changes require the victim to accept new conditions and “activate” their Certicode Plus—a legitimate security feature used by the bank for transaction verification. The threat of card suspension is used to pressure the victim into clicking a malicious link.

How it works:
The victim receives this message (likely by email) claiming to be from La Banque Postale. The message:

• States that regulatory changes require the victim to accept new conditions for online card purchases
• Prompts the victim to click a link to “activate” Certicode Plus
• Warns that failure to confirm will result in the suspension of online card purchases and blocking of the card

When the victim clicks the link, they are taken to a phishing page designed to capture their banking credentials, personal information, or Certicode Plus verification codes.

The goal:
The attacker aims to:

• Steal the victim’s La Banque Postale online banking credentials
• Capture Certicode Plus verification codes (two-factor authentication)
• Obtain card details or other personal information

With this information, the attacker can access the victim’s bank account, make unauthorized purchases, and commit fraud.

Red flags to watch for:

• Suspicious link: The message contains a link (disguised as “Active+Votre-Mobile”) that leads to a phishing site. Legitimate La Banque Postale communications do not require customers to click links to activate security features.
• Threat of suspension: The warning that the card will be blocked if no action is taken is a classic fear-based tactic to pressure victims into acting without thinking.
• Unsolicited request: La Banque Postale does not send emails with links requiring customers to “accept new regulations” or “activate” Certicode Plus via external links. Legitimate security features are activated within the app or after logging into the official website.
• Generic greeting: The message does not address the victim by name or reference a specific account number—common in phishing emails.
• Vague regulatory reference: The message refers vaguely to “regulatory changes” without specifics, a common phishing tactic.
• Poor formatting: While the design mimics La Banque Postale’s branding, the layout and language contain stylistic inconsistencies compared to official communications.

What to do if you encounter this:

• Do not click any link in the message.
• Do not enter any personal information, banking credentials, or Certicode Plus codes on any page reached via this link.
• If you are a La Banque Postale customer, always access online banking by typing labanquepostale.fr directly into your browser or by using the official mobile app.
• If you have already clicked the link and entered any information, contact La Banque Postale immediately through their official customer service hotline to secure your account.
• Report the phishing email to La Banque Postale’s fraud department (e.g., by forwarding it to [email protected] or using their official reporting channel).

Why this scam is effective:
La Banque Postale has millions of customers in France. Certicode Plus is a real security feature used by the bank for transaction verification, so references to it are familiar and appear legitimate. The threat of card suspension creates urgency, prompting victims to click the link without carefully checking its destination. The message’s design and language closely mimic official bank communications.

Protective measures:

• Never click links in unsolicited emails or messages claiming to be from your bank. Instead, type the official bank URL directly into your browser.
• Be suspicious of any message that creates urgency, threatens consequences (such as card suspension), and asks you to click a link to “activate” or “verify” something.
• Check the sender’s email address carefully. Legitimate La Banque Postale emails come from @labanquepostale.fr or specific subdomains—not from generic or misspelled addresses.
• Enable Certicode Plus through the official app if you haven’t already, and remember that legitimate activation processes happen within the app or after logging into the official website—not via a link in an email.
• If in doubt, contact La Banque Postale directly using a phone number from your bank statement or the official website—never use contact information provided in the suspicious message.

---

Thank you for sharing these four screenshots. They show a multi-step phishing campaign impersonating Nickel, a French neobank (a subsidiary of BNP Paribas) that offers fee-based bank accounts typically sold in tobacco shops. The scam is designed to capture the victim’s identifier, access code, SMS verification code, and full card details—enabling full account takeover and card fraud. Here is a detailed English description that avoids exact quotes from the screenshot content to minimize antivirus false positives.

---

Threat Analysis: Nickel Phishing – Multi-Step Credential, SMS Code & Card Data Harvesting

This phishing campaign impersonates Nickel, a French neobank popular for its accessible accounts. The scam uses a multi-page flow to capture the victim’s identifier, access code, SMS verification code, and full card details (card number, expiration date, CVV). By harvesting all of this information, attackers can gain full access to the victim’s account and use the card for fraudulent transactions.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Login Page (Identifier Entry)
The first page asks for the victim’s identifier (which, according to the page, is found on the back of the physical Nickel card). It also includes a “Remember me” checkbox and options for first-time connection or card opposition.

Step 2 – Fake Access Code Page with Virtual Keyboard
The second page asks for:

• Identifier (pre-filled or re-entered)
• Access code (a numeric PIN) using a virtual keyboard

The virtual keyboard is a common security feature in French banking, used to protect against keyloggers. Its presence here is intended to make the page appear legitimate.

Step 3 – Fake SMS Code Page
The third page asks for the SMS code sent to the victim’s mobile phone. This is the two-factor authentication (2FA) code used to verify the login.

Step 4 – Fake Card Details Page
The fourth page requests full card details.

This page is designed to capture all the information needed to use the victim’s card for online purchases or to clone the card.

The goal:
The attacker aims to:

• Steal the victim’s Nickel account credentials (identifier and access code)
• Intercept the SMS verification code (2FA)
• Obtain full card details (number, expiration, CVV)

With this combination, the attacker can:

• Log into the victim’s Nickel account
• Make online purchases using the card details
• Potentially withdraw funds or transfer money
• Commit identity theft using the victim’s personal information

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not nickel.eu or any official Nickel domain. Legitimate Nickel online access is through the official website or app. Always check the address bar.
• Multiple sensitive data requests: A legitimate login process would not ask for identifier, access code, SMS code, and full card details in sequence. This combination is a clear sign of a phishing kit.
• Unsolicited login request: Nickel does not send emails or messages with links requiring customers to log in and provide this level of information to resolve account issues.
• Card details page after login: After successfully entering credentials and SMS code, a legitimate bank would not ask for full card details. This is a phishing page designed to capture card data after the victim believes they are already logged in.
• Virtual keyboard: While real Nickel uses a virtual keyboard for security, phishing pages often replicate this feature to appear legitimate. Its presence alone does not guarantee safety.
• Generic design: The pages mimic Nickel’s branding but lack the full account-specific information that would appear on a legitimate logged-in session.

What to do if you encounter this:

• Do not enter your identifier, access code, SMS code, or card details on these pages.
• If you are a Nickel customer, always access your account by typing nickel.eu directly into your browser or by using the official Nickel mobile app.
• If you have already entered your credentials and SMS code but not card details, contact Nickel immediately to change your credentials and secure your account. Assume the attacker may have already accessed your account.
• If you have entered your card details, contact Nickel’s fraud department immediately to block your card and dispute any unauthorized transactions.
• Report the phishing pages to Nickel’s fraud team.

Why this scam is particularly dangerous:
This is a complete account takeover and card fraud phishing kit. The multi-step flow closely mimics legitimate banking processes (identifier, access code, SMS verification), making it highly convincing. The final request for card details is especially dangerous because victims may believe they need to “re-enter” their card information after a security update. The virtual keyboard adds an extra layer of perceived legitimacy.

Protective measures:

• Bookmark the official Nickel login page and use that bookmark to access your account—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate nickel.eu domains, not on phishing sites.
• Never enter your SMS verification code on a page you reached via a link. Legitimate banks only ask for 2FA codes after you have initiated a login on their official site.
• Never enter your full card details (CVV included) after logging in. This is not a standard banking practice.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Nickel domains end with nickel.eu. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Nickel directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Banco G&T Continental Phishing – Credential & SMS Token Harvesting

This phishing campaign impersonates Banco G&T Continental, one of the largest banks in Guatemala. The scam uses a multi-page flow to capture the victim’s online banking credentials and then the SMS token (two-factor authentication code) , allowing attackers to bypass security measures and gain full access to the account.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Login Page (First Screenshot)
The first page asks for:

• Usuario (username)
• Contraseña (password)

This page captures the victim’s primary online banking credentials.

Step 2 – Fake Loading/Waiting Page (Second Screenshot)
The second page displays a fake loading message, stating that the victim’s credentials are being verified. A countdown timer (20 seconds) creates a sense of legitimate processing while the attacker, in the background, uses the stolen credentials to log into the real bank site and trigger an SMS token to the victim’s phone.

Step 3 – Fake SMS Token Page (Third Screenshot)
The third page asks for the SMS token (the two-factor authentication code sent to the victim’s mobile phone). When the victim enters this code, the attacker captures it and uses it to complete the login on the real Banco G&T Continental site.

The goal:
The attacker aims to:

• Steal the victim’s online banking credentials (usuario and contraseña)
• Capture the SMS token (2FA code) in real time
• Gain full access to the victim’s bank account to transfer funds, pay bills, and commit fraud

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not gyb.com.gt or any official Banco G&T Continental domain. Legitimate online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: Banco G&T Continental does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Fake loading page with countdown: Legitimate banking sites do not display artificial loading countdown timers during login. This is a classic phishing tactic to buy time for the attacker to use the stolen credentials on the real site.
• Multi-step design with SMS token request: After entering credentials, the victim is asked for the SMS token. This mirrors the real 2FA flow, making it convincing, but the pages are fake.
• No personalization or security image: Legitimate Banco G&T Continental login pages may display a security image or personalized greeting. These pages lack such features.
• Outdated copyright: The footer shows “2022” (the screenshots are from 2023). While not a definitive red flag, outdated copyright notices are common in phishing pages.

What to do if you encounter this:

• Do not enter your usuario, contraseña, or SMS token on these pages.
• If you are a Banco G&T Continental customer, always access online banking by typing gyb.com.gt directly into your browser or by using the official mobile app.
• If you have already entered your credentials but not the SMS token, contact Banco G&T Continental immediately to change your password and secure your account.
• If you have entered the SMS token as well, the attacker may have already accessed your account. Contact the bank’s fraud department immediately.
• Report the phishing pages to Banco G&T Continental’s fraud team.

Why this scam is particularly dangerous:
This is a real-time account takeover phishing kit. The attacker uses the stolen username and password immediately to log into the real bank site and trigger an SMS token. The fake loading page buys time for this process. When the victim enters the SMS token on the phishing page, the attacker uses it to complete the login—often within seconds. By the time the victim realizes something is wrong, the attacker may have already transferred funds.

Protective measures:

• Bookmark the official Banco G&T Continental login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate gyb.com.gt domains, not on phishing sites.
• Never enter your SMS token on a page you reached via a link. Legitimate banks only ask for 2FA codes after you have initiated a login on their official site.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco G&T Continental domains end with gyb.com.gt. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banco G&T Continental directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Banco Galicia Phishing – Fake “Acceso” Login Page

This phishing campaign impersonates Banco Galicia, one of the largest banks in Argentina. The page mimics the bank’s login interface to steal customers’ DNI (national identification number), Usuario Galicia (username), and Clave Galicia (password) —the three pieces of information typically required to access online banking.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Banco Galicia login page. When the victim enters their DNI, Usuario, and Clave and clicks “INICIAR SESIÓN” (the button is truncated but means “Log in”), the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s Banco Galicia online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not banco-galicia.com.ar or any official Banco Galicia domain. Legitimate Banco Galicia online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: Banco Galicia does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Missing security features: Legitimate Banco Galicia login pages typically include a virtual keyboard (which is mentioned but may not function) and a security image or personalized greeting. This page lacks the full security implementation.
• Typographical error: The login button reads “INICIAR SESI” (missing the final “ÓN”), which is likely a truncation error in the phishing page design. Official bank interfaces do not have such truncations.
• Poor grammar and truncated text: The text below the form is garbled and incomplete (“Olvidé o bloqueé n°1” followed by nonsensical Spanish). This is a clear indicator of a hastily assembled phishing page.
• Generic design: While the page uses the Banco Galicia logo and a simple form, it lacks the full navigation, account-specific information, and professional polish of the real bank website.

What to do if you encounter this:

• Do not enter your DNI, Usuario, Clave, or any other personal information on this page.
• If you are a Banco Galicia customer, always access online banking by typing banco-galicia.com.ar directly into your browser or by using the official Banco Galicia mobile app.
• If you have already entered your credentials, contact Banco Galicia immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Banco Galicia’s fraud department.

Why this scam is effective:
Banco Galicia has millions of online banking customers in Argentina. The page uses the bank’s logo and familiar terminology (“DNI,” “Usuario Galicia,” “Clave Galicia”), which are standard for the bank’s login process. The mention of a virtual keyboard (a real security feature used by the bank) adds a layer of perceived legitimacy. However, the truncation errors and garbled text are red flags that attentive users might notice.

Protective measures:

• Bookmark the official Banco Galicia login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate banco-galicia.com.ar domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your Banco Galicia account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco Galicia domains end with banco-galicia.com.ar. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banco Galicia directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---