Phishing Attacks Target Revolut Customers Following Data Breach
Hackers have taken advantage of a recent data breach at the digital financial firm Revolut to target customers with phishing attacks, according to findings from Malwarebytes. The security company reported that several Revolut customers received smishing messages via text, with one such message arriving on September 14, just two days after the bank publicly acknowledged the breach.
In one instance, the scam message was cleverly disguised within the same conversation thread as legitimate Revolut texts, making it appear authentic. The message prompted the recipient to follow a link to confirm their identity, warning that failure to do so would result in restricted access to their account.
A customer who clicked the link was directed to a webpage that requested access to their device's camera. This page mimicked the bank's live-video identity verification process, subsequently asking the user to enter their password. Malwarebytes noted that this tactic enhances the phishing page's credibility, potentially allowing scammers to collect a selfie or video for further identity fraud or social engineering schemes.
Risks of Account Hijacking Increase
The security firm cautioned that if these phishing attempts are directly linked to the data breach, rather than being opportunistic, the attackers could possess enough information to hijack victims' accounts. In light of this, Malwarebytes has urged Revolut customers to remain vigilant.
Filed & Cleared
Details surrounding the breach itself are still emerging. Reports suggest that the breach targeted Revolut's Lithuanian entity, which is required to respond to European Investigation Orders. The attackers impersonated Italian law enforcement by compromising email accounts at the Italian Ministry of the Interior, allowing them to submit fraudulent requests for Know Your Customer (KYC) information without raising suspicion.
It is believed that the hackers had access to these accounts for approximately six months, enabling them to submit multiple fraudulent data requests. The breach has reportedly impacted several hundred accounts, with high-net-worth cryptocurrency users being specifically targeted after the attackers analyzed blockchain records.
