Antiphishing.biz

This screenshot shows a phishing page impersonating Banco Hipotecario, an Argentine bank. The page presents a fake security alert or service notification, urging the victim to click a “VERIFICAR” (Verify) button, which leads to a fraudulent website designed to steal online banking credentials.

Analysis Memo: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the dangerous destination URL has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

---

Threat Analysis: Banco Hipotecario Phishing – Fake Verification Alert

How it works:
The victim receives a phishing email, SMS, or other message claiming a security issue, account update, or service interruption. The link leads to this page, which displays a message in Spanish asking the user to click “VERIFICAR” to continue enjoying the bank’s services. Clicking the button redirects the victim to a fake login page that requests online banking credentials (username, password, and possibly additional security codes).

The goal:
The attacker aims to steal the victim’s Banco Hipotecario online banking credentials to access the account, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not the official Banco Hipotecario domain (which would be bancohipotecario.com.ar).
• Unsolicited verification request: Banco Hipotecario does not send messages with links requiring customers to click a button to “verify” their account or continue using services.
• Vague threat / urgency: The message implies that failure to click will result in loss of service – a classic fear tactic.
• Minimal design: The page lacks the bank’s full branding, security notices, and contact information that would appear on a legitimate communication.

What to do if you encounter this:

• Do not click the “VERIFICAR” button.
• If you are a Banco Hipotecario customer, always access online banking by typing the official URL directly into your browser.
• If you have already clicked and entered credentials, contact the bank immediately to secure your account.
• Report the phishing page to Banco Hipotecario’s fraud department.

Protective measures:

• Never click links in unsolicited messages claiming you need to verify your account.
• Always type your bank’s official website address manually.
• Enable two‑factor authentication on your bank account if available.
• Be suspicious of any message that creates urgency and asks you to click a button.

---

Analysis Memo: This malicious interface was intercepted, verified, and locked down firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the phishing source domain has been safely deactivated within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Updated 2021-09-17.

New phishing attack detected:

Below are the descriptions for the two phishing screenshots.

---

1. Brubank Phishing – Fake “Open in App” Redirect

Threat Analysis:
This page impersonates Brubank, a digital bank in Argentina. The victim is shown a prompt claiming they need to open the link in the Brubank mobile app to continue an action. The URL contains a subdomain of ngrok.io – a legitimate service often abused by attackers to host phishing pages. The “USAR BRUBANK APP” button likely leads to a fake login page or attempts to trigger a malicious redirect.

How it works:
The victim receives a phishing message (SMS, email, or chat) stating that an action requires app confirmation. The link leads to this page, which mimics Brubank’s interface. Clicking the button may open a fraudulent website designed to steal the victim’s banking credentials, one-time passwords (OTP), or session tokens.

Red flags:

• The domain is ngrok.io, not the official Brubank domain.
• Legitimate banking apps do not ask users to click external links to “open the app” for verification.
• The page is minimal and lacks official branding beyond a copied logo.

What to do:

• Do not click any button.
• Always access your bank by typing the official URL directly or using the official app from a trusted store.
• If you already clicked and entered credentials, contact Brubank immediately.

---

2. Generic Account Blocked Phishing – Fake Security Alert

Threat Analysis:
This page uses a fake security alert claiming that the user’s account has been blocked. A button labelled “DESBLOQUEAR” (Unlock) is presented. Clicking it leads to a credential‑harvesting page, likely asking for email address, password, or other personal information.

How it works:
The victim receives an unsolicited email or message stating their account is blocked due to suspicious activity. The link leads to this page. The victim is pressured to click the unlock button, which redirects to a fake login portal that steals credentials.

Red flags:

• Generic branding (“YOUR WEBSITE”) and template text copied from a free website theme.
• No legitimate company name or logo is displayed.
• Threat of account blockage is a classic fear tactic.
• The “Contact us” section contains placeholder information (e.g., [email protected]).

What to do:

• Do not click any button.
• Legitimate security alerts from real companies will not ask you to unlock your account via an external link.
• Always log in directly through the official website of the service in question.
• If you have already entered credentials, change your passwords immediately and enable two‑factor authentication.

---

These two screenshots form a two‑step phishing campaign impersonating Crédit Agricole, a major French bank. The first page is a fake welcome / regional selection page, and the second page is the actual credential‑harvesting login form.

Security Notice: This spoofed page was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the dangerous destination URL has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

---

Threat Analysis: Crédit Agricole Phishing – Fake “Accès CR” Login Page

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to log in to their online banking. The link leads to the first page, which mimics the legitimate Crédit Agricole public portal (with menus for accounts, cards, savings, etc.). Clicking “VALIDER” (or a similar button) leads to the second page.

The second page asks for:

• Identifiant – an 11‑digit identifier (example shown: 982662721)
• Code personnel – a 6‑digit personal code (password)

A fake virtual keyboard (digits 0–9) is displayed to make the page appear more legitimate and to bypass simple keyloggers. The victim is instructed to enter their credentials and click “VALIDER.” The information is then sent to the attacker.

The goal:
The attacker steals Crédit Agricole online banking credentials (identifier + personal code) to:

• Log into the victim’s real bank account
• View balances, transfer funds, and make unauthorized payments
• Perform further fraud or identity theft

Red flags to watch for:

• Suspicious URL: The pages are hosted on a domain that is not credit-agricole.fr. Legitimate Crédit Agricole login pages are only on official bank domains.
• Unsolicited login request: Crédit Agricole does not send links requiring customers to log in to resolve account issues.
• Fake virtual keyboard: While the real bank may use a virtual keyboard, its presence on a fake page does not guarantee legitimacy – the page is still a phishing site.
• Copied content: The first page copies legitimate Crédit Agricole branding and menus (e.g., “COMPTES & CARTES”, “Télécharger l’application Ma Banque”). Attackers use this to appear authentic, but the domain gives it away.
• No personalization or security image: A legitimate login page often displays a security phrase or image after identifier entry – this page does not.

What to do if you encounter this:

• Do not enter your 11‑digit identifier or 6‑digit personal code.
• If you are a Crédit Agricole customer, always access online banking by typing credit-agricole.fr directly into your browser or using the official mobile app.
• If you have already entered your credentials, contact Crédit Agricole immediately to change your access codes and secure your account.
• Report the phishing page to Crédit Agricole’s fraud team ([email protected]).

Protective measures:

• Bookmark the official Crédit Agricole login page and use that bookmark.
• Use a password manager – it will not autofill on fake domains.
• Enable two‑factor authentication (SécuriPass) through the official app.
• Be suspicious of any unsolicited message that asks you to log in via a link.
• Check the URL carefully – look for misspellings, extra words, or unusual top‑level domains.

---

This set of screenshots shows a phishing campaign impersonating La Banque Postale, a major French bank. The scam uses a fake regulatory notification (PSD2 / European security directive) to pressure victims into clicking a link that leads to a fraudulent login page, where their online banking credentials (identifiant and password) are stolen.

Threat Intel: This spoofed page was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the phishing source domain has been safely deactivated within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Upd: The second attack 12 days latter

---

Threat Analysis: La Banque Postale Phishing – Fake “Strong Authentication” Scam

How the scam works:

Step 1 – Fake Regulatory Alert (First Screenshot)
The victim receives an email or lands on a page claiming that due to new European regulations, online banking logins now require “strong authentication” every 90 days. The message warns that ignoring the request will lead to the deactivation of security programs on the account – a classic fear tactic. A button labelled “ACCÉDER À L’INTERFACE” (Access the interface) directs the victim to the next page.

Step 2 – Fake Login Page (Second and Third Screenshots)
The victim is taken to a page that mimics La Banque Postale’s client space. The page asks for:

• Identifiant (login identifier)
• Mot de passe (password)

A fake virtual keyboard (showing digits 0–9) is included to make the page appear more legitimate. The page also contains a warning about phishing attempts – ironically, this warning is copied from the real bank’s website and placed on a fake page to trick victims into believing the site is authentic.

The goal:
The attacker steals the victim’s La Banque Postale online banking credentials to:

• Log into the victim’s real bank account
• View balances, transfer funds, and make unauthorized payments
• Commit fraud or identity theft

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not labanquepostale.fr. Legitimate La Banque Postale login pages are only on official bank domains.
• Unsolicited “regulatory” request: La Banque Postale does not send links requiring customers to log in to comply with PSD2 or any other regulation. Such updates are handled through the official app or website after normal login.
• Threat of consequences: The warning that ignoring the message will lead to deactivation of security programs is a classic fear tactic.
• Fake virtual keyboard: While the real bank may use a virtual keyboard, its presence on a fake page does not guarantee safety – the page is still a phishing site.
• Ironically, the anti‑phishing warning: The page includes a legitimate‑looking warning about fake emails and SMS, copied from the real bank. Attackers use this to appear credible, but it is being displayed on a phishing page itself.
• Copied content and branding: The page copies La Banque Postale’s menus, COVID‑19 notices, and social media links. This content is stolen from the real website.

What to do if you encounter this:

• Do not click any buttons or enter your identifier or password.
• If you are a La Banque Postale customer, always access online banking by typing labanquepostale.fr directly into your browser or using the official mobile app.
• If you have already entered your credentials, contact La Banque Postale immediately to change your access codes and secure your account.
• Report the phishing page to La Banque Postale’s fraud team (e.g., [email protected]).

Protective measures:

• Bookmark the official La Banque Postale login page and use that bookmark.
• Use a password manager – it will not autofill on fake domains.
• Enable two‑factor authentication (Certicode Plus) through the official app.
• Be suspicious of any unsolicited message that creates urgency, threatens account deactivation, and asks you to log in via a link.
• Check the URL carefully – look for misspellings, extra words, or unusual top‑level domains.

---