Phishing Campaign Targets Greek Banking Users

Cyble Research & Intelligence Labs discovered a phishing campaign impersonating Greek tax refund sites that uses JavaScript keylogging on fake bank login pages to capture and exfiltrate banking credentials; the report provides technical analysis of the keylogger and network traffic, lists multiple phishing URLs and an associated IP (195.178.120.25) as IOCs, and offers mitigation recommendations.