CERT-AGID identified a new sextortion campaign circulating internationally since April 2026 and observed for the first time in Italy, with scammers impersonating ShinyHunters. The emails claim to have compromising material and demand $2,000 in Bitcoin within 48 hours, but ShinyHunters denied any involvement. #ShinyHunters #CERTAGID

CERT-AGID identified a phishing campaign that impersonates “Il Portale dell’Automobilista” through the typosquatted domain illportaledelautomobilista[.]org, which appears prominently in Google search results. The fake site steals personal and driver-license data such as codice fiscale, numero patente, and expiration date, while CERT-AGID has requested takedown actions and alerted Google and the Ministry of Infrastructure and Transport. #CERTAGID #IlPortaledellAutomobilista #MinisterodelleInfrastruttureeDeiTrasporti #illportaledelautomobilistaorg

CERT-AGID identified a phishing campaign using INPS branding to steal personal data, payment card details, and push victims into approving unauthorized banking transactions. The attack lures users with a supposed €730 refund tied to a “tax and contribution recalculation” and directs them to a fake site on feedsafepro[.]com that imitates the INPS portal. #INPS #CERT-AGID #feedsafepro

CERT-AGID reports a steady rise in suspicious and abusive messages sent through legitimate Italian PEC mailboxes, with over 650 events handled since January 2026. The agency is coordinating with PEC providers to reset compromised accounts or shut down malicious ones, while warning recipients not to click suspicious links or open unknown attachments. #CERT-AGID #PEC #malware@cert-agid.gov.it

CERT-AGID identified new smishing campaigns abusing INPS branding, logos, and graphics to steal personal data and payment card information through fake debt-payment pages. The campaigns use two distinct page designs and payment amounts, suggesting possible A/B testing, affiliate distribution, or targeted sending to different victim lists. #INPS #CERT-AGID

CERT-AGID identified a phishing campaign that abuses the names and visuals of Polizia di Stato and pagoPA to trick victims into paying a fake traffic fine. The fraudulent flow collects vehicle plate data, tax code, email address, and payment card details, while domains containing “poliziadistato” were used to host the fake pages. #PoliziaDiStato #pagoPA #CERTAGID

CERT-AGID identified and disrupted a new MintsLoader campaign that abused compromised PEC mailboxes to send convincing fake invoice-payment messages to other certified email addresses. The attack chain delivered a ZIP file containing HTML, JavaScript, PowerShell, and MintsLoader components, with rotating infrastructure and DGA-based domains leading to final payloads such as RATs and stealers. #CERT-AGID #MintsLoader #PEC

CERT-AGID identified a phishing campaign abusing the name, logo, and graphics of the Automobile Club d’Italia (ACI) to trick users into paying a fake annual vehicle tax debt. The fraudulent sites acitalia[.]info and acitalia[.]click collect personal data and card details while CERT-AGID has requested their takedown and shared the indicators with accredited organizations. #CERTAGID #AutomobileClubdItalia #ACI #acitaliainfo #acitaliaclick

CERT-AGID identified fraudulent sites impersonating PagoPA to steal personal data and payment card information by offering a fake TARI overpayment refund. The campaign used a staged online form to collect identity details, contact information, and card data for potential fraud and future phishing operations. #PagoPA #CERT-AGID #TARI

CERT-AGID observed a phishing campaign abusing the INPS name, logo, and visual identity to lure victims to a fake site that collects personal documents and photos. The fraudulent portal also uses an AI-based file validation step, reportedly identified as Gemini 1.5 PRO, to filter uploads and increase the quality of stolen data. #INPS #CERT-AGID #Gemini1.5PRO

CERT-AGID identified and disrupted a fraudulent website impersonating ARERA to trick users into revealing personal and financial data through a fake refund tied to the social water bonus. The site used typosquatting and a staged flow that led victims from a phone-number check to a bogus credit card verification page. #ARERA #CERT-AGID #bonussocialeidrico

https://www.osintinvestigate.com In questo episodio analizziamo le ultime notizie dal mondo della cybersecurity, con un focus su attacchi hacker, malware, ransomware e phishing. Scopriremo quali sono le minacce informatiche più diffuse, come operano i cybercriminali e quali strategie adottare per proteggere dati, dispositivi e identità digitali.Parleremo delle campagne malware che colpiscono l'Italia, dell'evoluzione del ransomware, del crescente utilizzo dell'intelligenza artificiale negli attacchi informatici e delle migliori pratiche di sicurezza per aziende e privati. Un appuntamento dedicato a chi vuole rimanere sempre aggiornato sulle principali minacce digitali e comprendere, con un linguaggio semplice e divulgativo, come difendersi in un panorama informatico in continua evoluzione.

Two WordPress core vulnerabilities, CVE-2026-60137 and CVE-2026-63030, can be chained into wp2shell to enable unauthenticated access, SQL injection, and potentially remote code execution on affected sites. CERT-AGID urges administrators, especially public-sector operators, to update to the fixed versions and inspect systems for signs of compromise such as suspicious batch API requests, new admin accounts, web shells, or unexpected database activity. #WordPress #CERT-AGID #CVE-2026-60137 #CVE-2026-63030 #wp2shell

CERT-AGID identified multiple active phishing campaigns on different domains that impersonate the Italian Ministry of Health to steal citizens’ personal and payment data. The scams use a fake 2026 health card replacement notice and a staged payment funnel to collect identity and credit card details. #CERT-AGID #MinisteroDellaSalute #AgenziaDelleEntrate #PosteItaliane

CERT-AGID identified new smishing campaigns abusing the INPS name to lure victims into a mobile-first fraud flow that ultimately steals credit card data for likely unauthorized charges. The activity intensified over four days with 14 campaigns across distinct domains, and technical analysis showed links to the Darcula Phishing-as-a-Service ecosystem. #INPS #CERTAGID #Darcula