Convincing Free Mobile phishing emails appear after data breach
Convincing Free Mobile phishing emails demand €9.99 and harvest card data after a 2024 breach.
Malwarebytes reports a polished phishing campaign impersonating French carrier Free Mobile after an October 2024 breach that exposed bank-account and login data. France’s CNIL fined Free Mobile €27 million in January for failures to protect customer data. On September 30, a customer received a branded email from a suspicious sender demanding €9.99 to avoid suspension; redirects led to a recently registered Cloudflare-hosted page requesting card details. Similar lures used lookalike domains including espace-free-mobile.pro, freesas.info, and regularisation-free.info.
- October 2024 Free Mobile breach exposed bank and login data.
- CNIL fined the carrier €27 million in January.
- Phishing email demands €9.99 to avoid service suspension.
- Lookalike Cloudflare-hosted pages request credit card details.
- Malwarebytes advises using mobile.free.fr or calling 3244.
- ATT&CK
- T1566.002 Spearphishing LinkT1036.005 Match Legitimate Name or LocationT1204.001 Malicious Link
- Vendors
- Free Mobile
- Victims
- Free Mobile
- Organizations
- Free MobileCNILMalwarebytesCloudflare
- Countries
- France
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | espace-free-mobile.pro | 41LE/regularisation/?impaye=92a9e77d…200 This final domain, espace-free-mobile.pro , is hosted by Cloudflare and was registered just a month a |
| domain | knowledgegrowthcenter.help | om the suspicious email address freemobile-regularisation[@]knowledgegrowthcenter[.]help . It included a link that appeared to point to regularisa |
From the original article
2 min read at malwarebytes.com
Free Mobile customers received very convincing phishing emails after major data breach.
By @fr33tux · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.