Group-IB, a leading creator of cybersecurity technologies to investigate, prevent, and fight digital crime, announced today that it has identified an ongoing phishing campaign targeting residents of Singapore, under the guise of subsidies from the government. The campaign, which began in mid-December 2024, involves victims clicking on a link found in a SMS, which would redirect them to a phishing website impersonating the government portal SupportGoWhere. From there, victims would be instructed to provide their personal information and credit card details, ostensibly for verifying their identity. Along with the submission of their credit card information, the victims would also be required to provide the issuing bank’s two-factor authentication (2FA) code, in order to claim the “subsidies”.
Screenshots of (left) the SMS received by victims, and (right) the phishing website created by fraudsters, impersonating the government portal SupportGoWhere.
Screenshots of the phishing website where victims would be required to provide their personal information (left), as well as financial information for verification purposes (right).
Screenshots of the phishing website where victims would be required to provide the 2FA codes sent by their issuing bank.
At the time of reporting, CERT-GIB has uncovered 30 active fraudulent websites associated with this campaign. Additionally, 592 dormant websites, likely linked to the same threat actor, were identified. These fraudulent websites, which are housed within the .TOP domain zone, could potentially be activated as part of the scheme.
A screenshot of Group-IB’s proprietary Graph Network Analysis mapping the threat actors infrastructure
Further analysis of the phishing website has revealed that the same phishing kit used by the fraudsters is being employed across various schemes, with implementations associated with other services such as the payment of parking fines, redemption of bonus points, and resolving issues with failed deliveries, among others.
“This phishing campaign highlights the ever-increasing scale of attacks and the ability of cybercriminals to mimic a wide range of services, including those of government entities, in order to exploit trust and steal sensitive information. It is crucial for individuals to remain vigilant and cautious when receiving unsolicited messages, particularly those requesting personal or financial details.”
Operational Director of Group-IB’s Unified Products
Group-IB recommends Singapore residents to take the following precautions:
- Verify authenticity: Avoid clicking on unsolicited links in SMS messages, especially those claiming to offer government subsidies or urgent actions.
- Check URLs: Look for inconsistencies in web addresses, especially if redirected to domains that differ from official government or business websites.
- Monitor financial accounts: Regularly review credit card and bank statements for unauthorized transactions.
- Report incidents: Report suspicious SMS messages or phishing attempts to relevant authorities through channels such as ScamShield.
