Mobile Banking Phishing Campaign

This report details an ongoing phishing campaign targeting UK mobile-only banks (notably Monzo and Revolut) that uses cloned login pages, SMS reply phishing and credential/OTP harvesting to enable account takeover; the author ties multiple domains to three Russian CIDRs and Chinese registrars, links the pages to the Cazanova Morphine phishing kit, and publishes 34 malicious domains and three IP ranges as IOCs.