RUNLIR – phishing campaign targeting Netherlands

Group-IB researchers detail the RUNLIR phishing campaign (active since March 2021) that used smishing and spoofed Dutch organization websites to harvest banking credentials and personal data; the campaign relied on BlackTDS geo/anti-bot filtering, Yalishanda bulletproof hosting, and uAdmin phishing kits and employed an unusual “cut the card” social-engineering step to enable physical collection of cards and subsequent fraud, affecting hundreds of connected domains and posing a significant financial risk to victims.