New “Spiderman” Phishing Service Targets Dozens of Major European Banks

You receive a message that appears to come directly from your bank. But When you click on the link, you may not notice any problems as you log in. However, you have just provided all of your information to a fraudster (this is how The Spiderman Phishing Service operates).

The Spiderman does not refer to a certain superhero. It is instead a new technology developed by criminals. Criminals all over Europe use this supposed "spider-man" tool as a means to obtain people's banking data and other financial information. The technology is incredibly well-designed, so it seems very legitimate.

What Is The Spiderman Phishing Service?​

The Spiderman Phishing Service is basically a phishing kit that criminals utilize in order to create fake versions of a bank's website and make it look identical to the bank's actual site. For example, criminals can create fake versions of popular banks within Europe such as Deutsche Bank, ING, CaixaBank, Volksbank, etc.

When someone logs on to the web page created by the criminals and enters their username and password information, the criminals will capture the following information:

• Username/password
• One Time Codes (OTP or PhotoTAN)
• Credit Card Number
• Cryptocurrency Wallet Address

The most troubling element of all of this is that the criminals have access to view this information while the individual is entering it.

How Dangerous Is This Scam?​

You may have heard of "Spiderman" phishing, a phishing scam that is easy for even non-technical criminals to set up. The user interface of this tool has a dashboard where the crook can:

• Select the bank they want to "fake"
• Observe the transactions of their victim as they happen
• Target specific individuals

Because criminals distribute this tool via private chat groups, there's a larger pool of scammers that can use this tool and produce even more fake messages. Therefore, it leads to increasing the amount of fake bank message spam sent to everybody.

Why You Should Be Careful​

If you've ever received a text message stating "Please verify your account with us," that is how most scams begin. Once a scammer has your login information and your 2FA verification code, they can:

• Gain access to your bank account
• Withdraw funds
• Commit fraud using your identity

Even 2FA won't protect you if you enter the code(s) into a phishing site.

Summary​

Bottom line: Never trust any bank or financial institution link from an email or text message. Always check the email’s content from the bank's website or mobile application. If it appears to be suspicious or if you are in doubt, cease all activity and verify the email's origin.