MEA Shipment Phishing Scams Surge, Stealing Banking Data in Real Time

The report details an SMS-based phishing campaign across the Middle East and Africa where attackers send fake shipment failure messages that link to mobile-optimized phishing pages. These sites capture personal and financial data (including card details and OTPs) and use WebSocket connections, UUID session tokens, disposable domains, and SMS sender spoofing; the infrastructure is linked to the Darcula Phishing-as-a-Service toolkit. The advisory recommends verifying shipment links via official channels and strengthening domain monitoring, customer awareness, and anti-phishing protections.