Ongoing INPS Smishing Campaign Exploits Telegram Bots to Steal Personal Data

CERT-AGID has received a report from a user of the social network X regarding an active smishing campaign using the logo and name of INPS to induce victims to provide personal and financial data.

Through fraudulent but seemingly official communications, users are invited to follow a link to verify or update their information in order to receive a supposed payment of €280.

Stolen personal data

Once the link is clicked, victims are directed to a fake web page that replicates the style of the official INPS portal. Here, they are asked to enter:

• first and last name;
• tax code;
• city;
• phone number;
• credit card information;
• IBAN.

The collected data is sent directly to a Telegram bot, used by the attackers as Command & Control to automate and centralize the collection of stolen information.

Recommendations

CERT-AGID recommends that users remain highly vigilant regarding suspicious messages and adopt the following precautions:

1. Carefully verify the source of messages: be cautious of communications that require entering personal data through links.
2. Ensure you are on the official platform of the entity, carefully verifying the URL in the browser and ensuring it includes the official domain of the organization.
3. Report suspicious messages: forward doubtful communications to CERT-AGID at the address malware@cert-agid.gov.it

Indicators of Compromise

The IoCs related to this campaign have already been shared with organizations accredited to the IoC feed of CERT-AGID.

Link: Download IoC