Explanation
The objective of this phishing campaign is to obtain personal information, credit card information and LuxTrust credentials from unsuspecting individuals.
A simple math problem has to be solved by the user. This looks like human verification tests commonly found on websites.
After that, the victim is informed that the validity of their insurance card has expired and they are asked to provide their name, birthday and email address.
The following page continues the collection of personal information by asking for address information and phone number.
After that, credit card information is phished.
In the last step, the victim’s LuxTrust credentials are requested.
Before the “confirmation” of the successful transaction is shown to the victim, a fake loading page pretends to create a connection to Visa / Mastercard to verify the transaction.
When the victim clicks on “Retour à l’accueil”, they are redirected to the legitimate CCSS page.
All the previously described steps take place on pages under the malicious domain ‘centre-cnlu[.]info’ .
Example
