Explanation
The goal of this phishing campaign is to steal personal data as well as credit card information.
The distribution method is unknown since only the phishing link was provided to us.
In this phishing attempt the threat actor impersonates the Caisse Nationale de Santé (CNS) and claims that the user’s social security card needs to be renewed as it expires soon.
By clicking on the ‘Procéder à la mise à jour’ button, the user is redirected to a form asking for personal information (including the user’s social security number and address). After entering the personal information and going to the next step the user will be asked for their credit card details.
In the background, all collected information is sent to the malicious actor
All the steps take place on pages under the malicious domain ‘csn-lu[.]plsled[.]com’ .
Example
