CTM360 Exposes Global Gov Trap Campaign With 11,000+ Fake Government Portals Targeting Citizens Worldwide
Summary: CTM360's research describes a campaign it calls GovTrap, in which more than 11,000 malicious domains impersonate government portals, replicating branding, language, workflows and service structures for tax, licensing, vehicle registration and social benefit services. The campaign is distributed through SMS, email phishing and social media, uses low-cost top-level domains such as .me, .com, .cc, .vip and .icu, and localizes content by country across North America, Oceania, Europe and Asia.
What's compelling: Attackers register and deploy new domains daily, so each takedown is met with multiple replacements - meaning the 11,000-domain count is a moving target, not a fixed list to block. Stolen data and payment details are reused for identity theft, account takeover and underground resale, and funds move through money mule networks that make recovery difficult.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026