Loading story…
Finland’s National Cyber Security Centre warned that phishing messages are impersonating OmaKanta, Kanta, and Suomi.fi services to steal victims’ online banking credentials and personal identity data. The fraudulent messages have been distributed through SMS, email, and search-engine results, often using fluent Finnish, spoofed sender details, and fake websites made to resemble legitimate public-service portals such as kanta.fi. Some lures claim recipients must update their information before a deadline, report a technical problem in the Suomi.fi mobile application, or state that an account has been locked.
Authorities said the campaign has also included requests for victims to submit photos of identity documents such as passports, driver’s licenses, national ID cards, or residence permits. The Digital and Population Data Services Agency separately warned about scam traffic abusing the Suomi.fi brand, while officials stressed that these services do not request sensitive information by text message or email. People who clicked links or submitted banking details were urged to contact their bank immediately, file a police report, monitor accounts and bills for misuse, and notify the National Cyber Security Centre.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The Digital and Population Data Services Agency also warned about several other scam messages circulating under the Suomi.fi brand. Authorities advised people not to reply, click links, or submit sensitive information, and told affected victims to contact their bank, file a police report, and notify the National Cyber Security Centre.
During the week covered by the June 2024 bulletin, Finland's National Cyber Security Centre reported numerous phishing messages sent in the names of OmaKanta and Suomi.fi to steal online banking credentials. The messages urged recipients to update information before a deadline or cited a technical issue in the Suomi.fi mobile app, directing them to convincing fake websites.
Finland's National Cyber Security Centre received reports of a phishing campaign using search engines, SMS, and email to impersonate Kanta and OmaKanta services and steal personal data. Some messages claimed accounts were locked and asked victims to submit identity document photos, while linked sites mimicked the legitimate kanta.fi service.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Finland’s National Cyber Security Centre reported that February saw a continued surge in **fraud and social engineering**, including bank- and authority-impersonation scam calls, robocalls, high-quality phishing, and investment/crypto scams. The agency also noted that **Microsoft 365 (M365) account compromises increased further**, warning that stolen user accounts can enable follow-on abuse such as invoice fraud, CEO fraud (BEC), and large-scale secondary phishing sent from trusted, compromised mailboxes; it also cited multiple critical vulnerabilities in widely used software/services during the month, though impacts in Finland were described as limited. Separately, Finland’s Security and Intelligence Service (**SUPO**) assessed that **Russia and China** continue extensive **cyber-espionage and influence operations** targeting Finland’s technology sector, research institutions, and government, describing cyber-espionage as the country’s most significant digital threat with no expectation of abatement. SUPO said foreign intelligence activity combines cyber intrusions with traditional espionage and political influence to collect sensitive information and shape decision-making, and pointed to prior high-profile incidents (e.g., the Vastaamo psychotherapy data breach and related extortion cases) as illustrative of the broader risk environment.
Jun 29, 2026
Multiple reports describe **social-engineering scams** that impersonate trusted brands and payment providers to drive victims into credential theft or direct monetary loss. A “crypto compensation” lure abuses a legitimate-looking *Yandex* poll as an entry point, then redirects victims to a fake Bitcoin payout page claiming an approved `0.943 BTC` transaction and imposes a small “commission”/fee to withdraw funds—classic advance-fee fraud wrapped in a polished, multi-step funnel (including a fake chat “support agent”). Separately, Japanese-language phishing emails impersonating **ANA**, **DHL**, and **myTOKYOGAS** show consistent infrastructure patterns (notably `.cn` domains in sender and landing-page URLs), suggesting a single operator or shared kit targeting Japanese-speaking recipients. Several consumer scam advisories highlight **SMS-based fraud alerts** that push targets to call attacker-controlled phone numbers, where scammers pose as “support” to steal **Apple ID/2FA codes** or payment details, or to coerce victims into moving money. One PayPal-themed case escalated to cash withdrawals handed to a courier after a victim called a number from an unsolicited text, illustrating how “fraud department” pretexts can transition from phishing to **cash-out theft**. Additional warnings cover lookalike payment sites (e.g., `payyourbill.aps medical.com`) and generic guidance on what to do after clicking a phishing link; these are broadly consistent with the same theme (phishing/payment fraud) but are not tied to a single, specific campaign or actor across all items.
Jul 2, 2026
Group-IB reported that a large-scale phishing operation dubbed **0ktapus** targeted organizations using Okta by sending employees SMS messages that linked to fake Okta sign-in pages. The campaign harvested usernames, passwords, and one-time **2FA** codes, allowing attackers to use stolen credentials almost immediately before the codes expired. Researchers said the operation relied on relatively simple infrastructure, including **169 phishing domains**, a **Nuxt.js** frontend, a **Django** backend, and **Telegram** bots and channels used to collect stolen data in near real time. The activity was linked to compromises across multiple sectors, including IT, cloud services, finance, telecommunications, and cryptocurrency, with victims concentrated in the United States and Canada. Group-IB said the campaign was active by at least March 2022 and expanded into supply-chain intrusions affecting **Twilio**, **Mailchimp**, and **Klaviyo**, with downstream impact on customers of **Signal** and **DigitalOcean**. The firm said the attackers likely sought access to private data, internal documents, financial assets, and user accounts, and it urged organizations to adopt phishing-resistant MFA such as **FIDO2 security keys**, verify login URLs carefully, and reset credentials and revoke sessions immediately after suspected compromise.
Jun 29, 2026