New Phishing Attack Impersonates gov.il: Data Stolen in Real-Time
Cyvore experts have uncovered a sophisticated phishing campaign impersonating the gov.il government portal. The attackers use an interactive system that steals personal data and credit card details as they are being typed, while also controlling the verification process in real-time.
Last week, the National Cyber Directorate warned of a scam impersonating the Israel Post. Now, a new phishing attack has been exposed, impersonating the government portal gov.il, after a malicious link was scanned via the MAX website and submitted for inspection.
According to an analysis by the company Cyvore, this is an interactive phishing system that allows the attacker to track the victim in real-time, extract details while they are being typed, and move the victim between verification screens based on their response.
"This was not just another amateur phishing message, but a live attack system that accompanies the victim in real-time, steals the details while they are being typed, and can even change the screen according to what the attacker needs at that moment," says Iftach Rotem, co-founder and CPO of the company. According to him, the site was taken offline yesterday, but since it is part of an attack campaign, it may return in different versions.
The malicious link was distributed via SMS messages, supposedly on behalf of the "Israel Traffic Authority," a body that does not exist. The messages claimed that the vehicle owner had committed a traffic violation and was required to pay a fine of 100 shekels.
Clicking the link leads to a site built to look like a legitimate government service. Behind the shell is an infrastructure designed to collect a phone number, credit card details, a one-time verification code (OTP), bank app confirmation, address, and other personal details.
One of the serious findings in the check is that the system does not wait for the user to click the submit button. According to the analysis, the code transmits the content of the fields to the attacker while typing, using input_text events that are sent with every keystroke. This means that even if the user realizes something is suspicious and closes the window before completing the process, some or even all of the information entered may have already reached the attacker.
The system allows the operator to control the screen displayed to the victim in real-time. Commands were found in the code that move a user to an OTP entry screen, a custom verification screen, an app confirmation screen, success and error screens, and a return screen. In addition, the operator can refresh the page, block a user, or remove them from the process.
In practice, the victim enters the details, the attacker checks them against a real service, and depending on the result, decides what will be displayed in the next stage. An incorrect code can lead to a request to enter an additional code, a confirmation request from the bank can move the victim to a screen asking them to approve an action, and an unsuitable card can lead to a request to try another card.
According to the analysis, the code creates a unique identifier for each victim and saves it in several storage mechanisms in the browser, including Cookie, localStorage, sessionStorage, and IndexedDB. The system synchronizes the same identifier between the mechanisms, so even after reloading the page or clearing some of the information in the browser, it may recognize the user and return them to the same process.
The check also revealed a strong technical connection between the attack that impersonated gov.il and a previous phishing campaign that impersonated the Israel Post. According to the analysis, similar control mechanisms, the same communication events, and the same API path were found in both campaigns, alongside card, OTP, and app confirmation screens.
The main difference is in the packaging. In the previous campaign, an impersonation of the Israel Post was presented, which included a small payment for shipping. In the new attack, the same infrastructure was adapted to a government look, with a reference to gov.il and files intended to mimic a government service portal.
According to the technical assessment, it is possible that this is another version of the same phishing kit or the same source code, which has been adapted for another brand. However, the code alone does not prove that the attacks were operated by the same person or the same group.
The system also knows how to keep unwanted visitors away. If the server decides to block a user, the code can redirect them to the real gov.il website. Thus, a researcher, an automatic scanner, or a suspicious user might see a normal government site and think the link was legitimate.
How can you protect yourself?
To reduce the risk, it is recommended to access government, bank, credit card company, and Israel Post websites only through an address typed manually or via an official app. Do not provide card details, an OTP code, or app confirmation following a link received via SMS, WhatsApp, email, or an advertisement. If in doubt, you can scan the link at scanmysms.com.
A one-time verification code may be the final step that allows an attacker to complete a transaction or take over an account. If a site asks to enter a code repeatedly, to quickly approve an action in an app, or to try another card, you should stop the process and contact the relevant body directly.
