\n<\/p>\n
A sophisticated phishing campaign is targeting Greek mobile users with fraudulent text messages falsely promising fuel subsidies, investigators have found.<\/p>\n
The scam messages tell recipients they are entitled to financial assistance through a fictitious \u201cFuel Pass III\u201d program, urging them to click a link and enter personal and banking details. The messages are well-written and grammatically correct, exploiting a real government program to appear credible.<\/p>\n
Andreas Venieris, an information systems security officer, traced the operation to a Frankfurt server belonging to Tencent, the Chinese cloud computing service, with 50 near-identical fake government domains registered at the same address.<\/p>\n
\u201cThe attacker is not in Germany \u2013 they simply rented a server there,\u201d Venieris said. \u201cThe use of the Chinese service suggests a possible connection with China or Southeast Asia, but even that is not certain.<\/p>\n
\u201cThe redundancy is deliberate,\u201d he added. \u201cIf one domain gets blocked, the remaining 49 continue operating.\u201d<\/p>\n
Victims who click the link are walked through a convincing replica of Greece\u2019s official benefits portal, eventually surrendering bank card details. When their bank sends a one-time password, the fake site captures it \u2014 completing the theft.<\/p>\n
Venieris described the scheme as \u201ca complete Phishing-as-a-Service kit\u201d that can also impersonate courier companies, banks, and online retailers, suggesting an organized group selling criminal infrastructure to other bad actors.<\/p>\n
Public authorities, officials stressed, never request bank details by text message.<\/p>\n<\/p><\/div>\n