Absher update SMS leads through fake government and bank logins

Documented campaign

How the approach works

An update-information SMS leads to a cloned login, an OTP prompt, a registration form and then a bank-selection and login page. The researcher observed that any four-digit code was accepted by the fake portal.

What they wanted

Steal login credentials and personal information

Reported outcome

Credential-collection flow documented; individual losses unknown.