CERT-AGID identified a phishing campaign that abuses the branding of the Fascicolo Sanitario Elettronico, Ministry of Health, Department for Digital Transformation, and Ministry of Economy and Finance to steal personal and payment card data. The fake site lures victims with a supposed 19% pharmacy refund and then collects identity details and card information before showing a fabricated “in processing” confirmation. #CERT-AGID #FascicoloSanitarioElettronico #MinisteroDellaSalute #MinisteroDEconomiaEDelleFinanze
Keypoints
- CERT-AGID detected a new phishing campaign using institutional graphics and logos to impersonate Italian public bodies.
- The campaign specifically abuses the Fascicolo Sanitario Elettronico, the Ministry of Health, the Department for Digital Transformation, and the Ministry of Economy and Finance.
- The lure is a fake 19% reimbursement for pharmacy medicine purchases, shown as €20.73.
- The fraudulent site uses a four-step flow, including a fake CAPTCHA, a reimbursement notice, personal data collection, and payment card theft.
- The attackers request full identity details and complete card data, including cardholder name, number, expiration date, and CVV.
- The final page shows a false protocol number, “In elaborazione” status, and a fake support number while referencing the Agenzia delle Entrate.
- The stolen data can be used for fraudulent transactions, resale in illicit markets, and further social engineering attacks such as vishing and smishing.
MITRE Techniques
- [T1566 ] Phishing – The campaign uses a fraudulent website with institutional branding to trick victims into entering personal and payment data (‘nuova campagna di pshihing’ / ‘campagna di phishing’).
- [T1114 ] Email Collection – The form asks for email as part of the personal data harvest (‘telefono ed email’).
- [T1005 ] Data from Local System – Not mentioned.
- [T1583 ] Acquire Infrastructure – The attackers rely on a malicious domain to host the fake reimbursement site (‘dismissione del dominio malevolo’).
- [T1036 ] Masquerading – The site impersonates official services by using logos and graphics of public institutions (‘sfrutta grafiche e loghi istituzionali’).
- [T1110 ] Brute Force – Not mentioned.
- [T1056 ] Input Capture – The page collects sensitive user-entered information including identity and payment card data through web forms (‘inserimento completo dei dati della carta di pagamento’).
- [T1491 ] Defacement – Not mentioned.
- [T1584 ] Compromise Infrastructure – Not mentioned.
- [T1078 ] Valid Accounts – Not mentioned.
- [T1055 ] Process Injection – Not mentioned.
- [T1608 ] Stage Capabilities – The attack is staged through multiple sequential pages to build trust and evade automated analysis (‘quattro passaggi sequenziali’).
- [T1499 ] Endpoint Denial of Service – Not mentioned.
- [T1027 ] Obfuscated Files or Information – The fake CAPTCHA is used to hinder automated crawlers and analysis (‘serve a ostacolare i crawler automatici di rilevamento’).
- [T1204 ] User Execution – The victim is prompted to click “Conferma” to proceed (‘invitandolo a cliccare su “Conferma”’).
Indicators of Compromise
- [Domains ] Malicious reimbursement website hosting the phishing flow – unlisted domain from the “Download IoC” package, and other 1 domain
- [URLs ] Fake refund and confirmation pages used in the scam – homepage of the malicious site, final “Richiesta di rimborso trasmessa” page, and other 2 page URLs
- [Phone numbers ] Fake support contact shown to victims – falso numero verde di assistenza, and other 1 phone number
- [Organization names ] Impersonated institutions used as lures – Fascicolo Sanitario Elettronico (FSE), Ministero della Salute, Dipartimento per la trasformazione digitale, and Ministero dell’Economia e delle Finanze
- [Data fields ] Collected victim details on the forms – cognome, nome, data di nascita, CAP, indirizzo di residenza, città, telefono, email
- [Payment card data ] Card details requested for “refund” processing – titolare, numero di carta, data di scadenza, CVV