New Gov.il Phishing Scam Steals Israeli Credit Card and Verification Codes via SMS

A sophisticated phishing attack impersonating the Israeli government portal gov.il is targeting Israelis by stealing personal and credit card information through fake SMS messages. Cybersecurity firm Cyvore analyzed the attack, revealing it uses an advanced system that tracks victims in real time, capturing data as it is typed and dynamically altering the displayed steps based on user responses. The fraudulent messages claim to be from a non-existent "Traffic Authority in Israel," alleging the recipient committed a traffic violation and must pay a 100-shekel fine. Clicking the link leads to a fake government-like website requesting phone numbers, credit card details, one-time verification codes, and other personal data.

Cyvore found that the system transmits information to attackers during data entry without waiting for form submission. Attackers can also manipulate the victim’s screen flow, including prompts for verification codes, banking app confirmations, or success messages. Yiftach Rotem, co-founder and CPO of Cyvore, described the attack as a "live attack system" actively guiding victims in real time rather than a simple phishing message. Although the fake site has been taken down, it may reappear in new forms. Technical links were identified between this attack and a previous phishing campaign impersonating Israel Post, though no direct evidence connects the same attackers.

Authorities and cybersecurity experts advise Israelis not to access government, bank, or credit card websites via links received in messages. Instead, users should type URLs manually or use official apps. They also warn against sharing verification codes or approving banking app actions prompted by suspicious messages.