CERT-AGID identified a phishing campaign impersonating the Italian Revenue Agency to trick users into completing a fake “Cryptocurrency Tax Declaration,” using institutional branding, fake FAQs, and GDPR references to appear legitimate. The scam collects personal and crypto wallet data and ultimately prompts victims to import or connect wallets (Solana/Ethereum) to steal access. #CERT-AGID #AgenziadelleEntrate
Keypoints
- The campaign impersonates the Agenzia delle Entrate using its name, logo, institutional layout, FAQs, and GDPR references to appear authentic.
- Users are urged to act quickly via fake deadlines to complete a “Cryptocurrency Tax Declaration.”
- Multiple screens collect personal and financial information: name, surname, tax code, email, and phone number.
- Victims are asked to upload screenshots of their crypto wallet and provide additional details to simulate an official procedure.
- The final stage requests users to “import the wallet” or connect wallets, targeting Solana and Ethereum to exfiltrate wallet access and assets.
- CERT-AGID notified the affected organization and requested the registrar to promptly take down the malicious domain.
- Indicators of Compromise were shared with organizations accredited to CERT-AGID and a downloadable IoC report was provided.
MITRE Techniques
- [T1192] Spearphishing Link – The campaign uses a fraudulent site impersonating Agenzia delle Entrate to lure victims via fake deadlines and links (“…abuses the name and logo of the Agenzia delle Entrate…leverages presumed deadlines…”).
- [T1056] Input Capture – Multiple screens guide users to enter personal and financial data including name, tax code, email and phone number (“…collection of personal and financial data, including name, surname, tax code, email and phone number.”).
- [T1622] Compromise Accounts – Users are instructed to import or connect crypto wallets (Solana/Ethereum), enabling theft of wallet access (“…is asked to ‘import the wallet’…directly connect the crypto wallet to steal access.”).
- [T1585] Domain Registration for Malicious Use – The attackers registered a malicious domain to host the phishing page; CERT-AGID requested the registrar to remove it (“…requested the registrar to promptly remove the malicious domain.”).
Indicators of Compromise
- [Domain ] phishing site impersonating Agenzia delle Entrate – malicious domain hosting the “Cryptocurrency Tax Declaration” page (domain was reported to registrar; specific domain not listed in article).
- [File/Artifact ] uploaded wallet screenshots – victims were requested to upload screenshots of crypto wallets (examples not specified).
- [Blockchain Networks ] targeted wallet import/connect – Solana, Ethereum networks targeted to import transactions or connect wallets for credential/asset theft.
- [Report/Feed ] IoC disclosure – CERT-AGID shared IoCs with accredited organizations and provided a downloadable IoC report (link referenced: “download the IoCs of the campaign”).
Read more: https://cert-agid.gov.it/news/phishing-ai-danni-di-ade-falsa-dichiarazione-fiscale-criptovalute/