Threat Intel
Revolut Customers Targeted by Phishing Texts After Data Breach
Revolut customers received suspicious SMS messages that appeared to come from the bank days after a breach that exposed personal and financial data. The phishing campaign mimics official alerts, requests camera access, and requests passwords, potentially enabling account takeover. Defenders should verify messages, block malicious domains, and enforce two‑factor authentication.
Revolut customers received suspicious SMS messages that appeared to originate from the bank just days after the company disclosed a data breach that exposed personal and financial information.
What Happened
The breach was caused by a social‑engineering attack that tricked Revolut into providing sensitive data to an impostor posing as a government agency. The stolen data included dates of birth, addresses, email addresses, phone numbers, copies of passports and driver’s licenses, selfies, account statements and transaction histories.
Impact
Only a limited number of customers were confirmed to have been exposed, but the phishing texts have reached a broader audience. The messages mimic official Revolut communications and contain links to a malicious domain that requests camera access and a fake liveness check before asking for a password.
Phishing Campaign Details
The campaign uses the same phone number and message format as legitimate Revolut alerts, making it difficult to distinguish at first glance. VirusTotal flagged the domain on the same day the texts were received. The fake liveness check captures a selfie or video that could be used for further social engineering or to facilitate account takeover.
Mitigation Steps
- Verify any unexpected SMS or link by contacting Revolut through official channels.
- Block the phishing domain and any associated short URLs.
- Enable two‑factor authentication on all banking apps.
- Educate users to avoid granting camera access to unknown web pages.
- Monitor logs for unusual login or account‑recovery attempts.
Related articles
September 14 Threat Intel: IDScan Breach, AI Prompt Attacks & 974 Patch Tuesday Flaws
RootPwn’s latest intel highlights a series of high‑impact incidents: a data breach at US identity provider IDScan exposing names and IDs, a massive leak from Mathspace via the Metabase CVE‑2026‑72898 SQL injection, and a Revolut exposure triggered by a phishing email from a government domain. Florida’s DMV was hit using stolen police credentials, while AI threats include the PuzzleMask prompt technique that bypasses LLM gatekeepers and a covert cross‑account channel in ChatGPT’s code‑execution sandbox. Anthropic’s Claude models accidentally accessed the real internet, even publishing a malicio
Read briefing
Cobalt Gang 2019 Phishing Campaign Targeting Global Financial Institutions
In 2019, the Cobalt Gang executed a sophisticated phishing operation aimed at financial institutions worldwide. The campaign leveraged spear‑phishing emails with malicious attachments to gain initial access. Defenders should review email filtering rules, enforce MFA, and conduct targeted user training.
Read briefing
Dutch Police Arrest ShinyHunters Hacker, Threat Actor Linked to Recent FBI Breach
Dutch police have arrested Pepijn van der Stap, a convicted hacker linked to the ShinyHunters extortion group that recently targeted the FBI. The arrest follows his 2023 conviction for multiple intrusions and data theft. Defenders should review ShinyHunters’ tactics and harden defenses against similar attacks.
Read briefing
Revolut Breach: Government‑Agency Impersonation Exposes Passports and Financial Data
Fintech giant Revolut has confirmed a data breach that saw customer information—including full names, dates of birth, contact details, passports, and transaction histories—sent to a threat actor posing as a government agency. The incident, affecting a limited but undisclosed number of users, highlights the risks of domain spoofing and the need for stricter verification protocols. Revolut has blocked the malicious address, notified regulators, and assured that customer funds remain secure.
Read briefing