Monzo customers bombarded with phishing attacks

(Image credit: Shutterstock / ImYanis)

Millions of Monzo users are being targeted by a phishing attack looking to obtain victim passwords and other login credentials and take over their digital identities.

Monzo is one of the UK’s largest cloud banks, offering a fully online banking platform, and Mastercard debit cards, among others.

The company took to Twitter to notify users of the phishing campaign going around, and to help them stay safe. In a Twitter thread, it explained that an unknown threat actor is sending out SMS messages to Monzo users, in which they are asked to reactivate their session, or verify their account, by tapping on the link provided in the message.

TechRadar needs yo...

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.

>> Click here to start the survey in a new window <<

On the endpoint smartphone, the sender’s name is shown as MONZO, but the links, as it’s standard practice with phishing attacks, don’t lead to Monzo’s official website, but rather a fake landing page created to steal user credentials. 

So far, the following domains have been uncovered: 

  • monzo-notice[.]com
  • monzo-online-support[.]com
  • monzo-check[.]com
  • monzo-card-support[.]com
  • monzo-replacement[.]com
  • alert-monzo[.]com

Stealing identities

Should a gullible user click on any of these links, they’d be greeted with a landing page unlike Monzo’s official website, and an option to add their full name, phone number, and the Monzo PIN - basically everything an attacker would need to steal their identity and gain full access to their account.

Monzo wasn’t the only one investigating the issue, too. As reported by BleepingComputer, security researcher William Thomas was also looking into the matter, and found four more domains on the same ASN, this time targeting Revolut users:

  • revolut-cancel-support[.]com
  • revolut-cancellation[.]com
  • revolut-cancel-online[.]com
  • Login-revolut-resolve[.]com

"Research into the domain itself via uncovered 33 other identical sites, dating back to 11 November 2021," Thomas explained.

"All 34 domains were hosted on the same three CIDRs in Russian IP space with NForce Entertainment (AS43350). Interestingly, the Monzo-themed domains also used two Guangdong-based Registrars (Eranet and NiceNic)."

Mixing Chinese registrars and Russian IP addresses, BleepingComputer concludes, makes it hard to attribute the attack to a specific group, and even harder to take the campaign down. As usual, users are advised not to click on any links, or download any attachments, before verifying the identity of the sender.

Via: BleepingComputer

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.