Swiss Army Knife Phishing

Group-IB CERT-GIB identified an ongoing, large-scale phishing campaign (active since May 2019) targeting customers of 27 Vietnamese banks using ~240 short-lived domains to harvest PII and banking credentials and to perform OTP hijacking for account takeover and financial theft; the campaign uses customized SMS/Telegram/WhatsApp messages, shortened URLs, and bank-branded fake sites, has recorded at least 7,800 visitors to 44 tracked pages, and remains active with takedown efforts coordinated with registrars and VNCERT.