Peru loan phishing campaign impersonating financial institutions across Latin America
Campaign
Summary
Hide ▲
Show ▼
A Peru-focused loan phishing campaign has expanded across Latin America, putting users' card numbers, PIN codes, and banking credentials at risk. The operation has been active since 2024 and uses social media ads plus fake loan portals to collect usable financial data. Its validation-heavy flow helps the scammers filter for high-value victims and makes the fraud harder to spot.
Related Happenings
GitBait phishing campaign targeting Mexican banks
Campaign
H score20
First: 17.06.2026 17:00
Last: 17.06.2026 17:00
Sources 1
About this happening:
A **long-running GitBait phishing campaign** is stealing **banking credentials** from customers of **Mexican financial institutions**, using **GitHub Pages** and **SheetBest** to...
GitBait phishing campaign targeting Mexican banks
CampaignAbout this happening: A **long-running GitBait phishing campaign** is stealing **banking credentials** from customers of **Mexican financial institutions**, using **GitHub Pages** and **SheetBest** to...
FIFA-themed phishing-as-a-service market selling scam kits and ticket-buying bots
Threat Actor Meta
H score42
First: 05.06.2026 10:01
Last: 05.06.2026 10:01
Sources 1
About this happening:
A **FIFA-themed phishing-as-a-service market** is selling **ready-made scam kits** and **ticket-buying bots**, lowering the barrier for fraud operators and making takedowns less e...
FIFA-themed phishing-as-a-service market selling scam kits and ticket-buying bots
Threat Actor MetaAbout this happening: A **FIFA-themed phishing-as-a-service market** is selling **ready-made scam kits** and **ticket-buying bots**, lowering the barrier for fraud operators and making takedowns less e...
FBI public service announcement on fake FIFA websites
Public Sector Action
H score21
First: 28.05.2026 22:08
Last: 28.05.2026 22:08
Sources 1
About this happening:
The **FBI** and security researchers warn that **FIFA-themed fraud** is already targeting **World Cup 2026** fans ahead of the **June 11 kickoff**. Reported activity includes **mo...
FBI public service announcement on fake FIFA websites
Public Sector ActionAbout this happening: The **FBI** and security researchers warn that **FIFA-themed fraud** is already targeting **World Cup 2026** fans ahead of the **June 11 kickoff**. Reported activity includes **mo...
FIFA logins traded on dark-web markets
Data Leak
H score46
First: 27.05.2026 14:28
Last: 27.05.2026 14:28
Sources 1
About this happening:
Around **2,500 FIFA logins** have surfaced on **dark-web markets**, turning stolen credentials into an active exposure that can fuel account abuse and downstream fraud. The leak i...
FIFA logins traded on dark-web markets
Data LeakAbout this happening: Around **2,500 FIFA logins** have surfaced on **dark-web markets**, turning stolen credentials into an active exposure that can fuel account abuse and downstream fraud. The leak i...
Ghost Stadium FIFA World Cup fraud campaign
Campaign
H score41
First: 27.05.2026 14:28
Last: 27.05.2026 14:28
Sources 1
About this happening:
A **Ghost Stadium**-linked **FIFA impersonation fraud campaign** is targeting **2026 FIFA World Cup** fans with cloned **fifa.com** pages, fake ticket and hospitality offers, and...
Ghost Stadium FIFA World Cup fraud campaign
CampaignAbout this happening: A **Ghost Stadium**-linked **FIFA impersonation fraud campaign** is targeting **2026 FIFA World Cup** fans with cloned **fifa.com** pages, fake ticket and hospitality offers, and...
Timeline
-
21.01.2026 17:00 2 articles · 5mo ago
Group-IB uncovers Peru loan phishing campaign impersonating banks
Initial DisclosureGroup-IB discloses a Peru-focused loan phishing campaign that impersonates well-known financial institutions, uses targeted social media advertisements to drive victims to fake loan application portals, and filters submissions with validation checks before stealing usable card numbers, PIN codes, and online banking passwords. The campaign has been active since 2024, with about 35 unique ads identified between 2024 and 2025, at least 16 scam domains posing as a leading Peruvian bank, and around 370 unique domains overall; similar infrastructure has also impersonated financial brands in Colombia, El Salvador, Chile, and Ecuador.
Show sources
- Peruvian Loan Scam Harvests Cards and PINs via Fake Applications — www.infosecurity-magazine.com — 21.01.2026 17:00
- Peruvian Loan Scam Harvests Cards and PINs via Fake Applications — www.infosecurity-magazine.com — 21.01.2026 17:00