Info Guichet (Smishing) _{^(2023-04-27)}

Overview

Threat actors collecting personal information and credit card credential information

Explanation

Threat actors are using a phishing campaign that mimics the appearance of the official Luxembourgish government website (https://gouvernement.lu/fr.html).

The attack begins with a fake SMS (in some cases also with a fake e-mail) asking to pay a fee of 49 euros.

The SMS text reads as follows:

Info Guichet : Vous avez une contravention impayée d'un montant de 49€ à ce jour. Consultez votre dossier d'infraction via : https://public-guichet.lu

from: +33 6 22 51 10 23

Please note the order of the words and the use of - instead of . in the link https://public-guichet.lu. The original link is https://guichet.public.lu/fr.html

When clicking on the link (“https://public-guichet.lu), the user is first presented a fake form which asks for a verification code.
Once that information is provided, the victim is redirected to a card form. After which the victim is redirected to another fake form. This form asks for personal information.
Finally, a page is shown that the payment was “successful” to make the user believe that he was indeed interacting with guichet.lu.

Example

---

Prevention

If you are uncertain about the authenticity of an email, do not hesitate to contact the entity that seems to have sent you the email using a safe communication manner, using the phone for example (no phone number from the untrusted email must be used in order to verify the authenticity).
If you are working for the Luxembourgish government or are using any of the GOVCERT.LU services, it is important to forward phishing emails to us (using Reporting an incident or the Outlook button). This will allow us to take down phishing websites and protect members of our constituency.