CERT Orange Polska Warns of Phishing Aimed at PKO BP Clients

CERT Orange Polska has detected a phishing campaign aimed at customers of PKO Bank Polski. The scammers send emails that lead to a page impersonating the iPKO biznes banking panel, where they try to capture the login, the password and the second authentication factor.

The message is designed to look like routine bank correspondence, but the sender address gives it away: node-jegw56-core(@)ispgateway(.)de. In some cases the attackers also attach a PDF whose name suggests that account data must be updated. According to CERT Orange Polska, the file contains no malware. It is a genuine document used in dealings with business clients.

A multi-step redirect

Clicking the link does not take the victim straight to the fake bank. First comes an intermediary page whose address is written as an IPv4-mapped IPv6 string, a way of hiding an ordinary IPv4 address that can hinder automated analysis and make users less likely to spot the threat. Only then is the user redirected to biznes.rzad-pl(.)net, a site imitating the iPKO biznes login. The fraudsters even added a notice at the bottom of the page warning about fake messages from cybercriminals.

The attack does not end once the password is entered. The victim sees a progress indicator spinning for a long time, suggesting further login stages. Meanwhile the attacker may try to sign in to the real account and get the victim to approve an action in the banking app or to enter an SMS code, depending on how authentication is configured.

Analysts also recorded a second variant with no attachment. Here the email walks the recipient step by step through supposedly sending missing documents. A person who believes they are going through identity verification may in fact hand the criminal the second-factor code, making it easier to take over the account.

What to do

CERT Orange Polska stresses that this kind of phishing is not limited to PKO BP and can exploit the branding of other financial institutions. Anyone who has entered login details on a suspicious page should contact their bank immediately.