International travelers targeted in immigration-themed phishing campaign

A sophisticated phishing campaign that first targeted travelers heading to Singapore has expanded to exploit those traveling to other nations, including the United Kingdom and Malaysia.

According to a new research report by email security firm Cofense, the threat actors behind the attacks are targeting individuals trying to navigate those nation’s immigration systems before arriving at their destination.

Specifically, researchers say the social engineering campaign is exploiting the online submission process for immigration arrival cards, which users must complete before entering a country.

The scam, initially detected in September 2023 targeting travelers to Singapore, has been aimed at high-level executives.

How it Works

The scam itself is said to be especially effective during peak travel seasons (and given the current political climate in the US), where people are more likely to act quickly without verifying legitimacy.

Preying on the traveler's sense of urgency and unfamiliarity with immigration procedures – typical social engineering tactics – researchers say the scam begins with a phishing email “notifying the victim about the status of their arrival card and the urgent action they need to take.”

The attackers, who have already created fake immigration portals identical to the destination country’s official government websites, use the spoofed email to entice the victim to click on a link that redirects them to the fake government domains.

Using “fear-inducing language,” the fake "immigration" site then pressures the victim to “act immediately by threatening denied entry to the visiting country due to non-compliance,” the research found.

The sites continue to trick the user into entering sensitive personal and financial information, including credit card numbers, under the false pretenses of a required payment for processing their immigration arrival card.

Once a victim inputs their information, their personal data is “immediately harvested and exfiltrated to attacker-controlled servers in real-time,” researchers said

Cofense warns that the stolen data can be sold on dark web markets, used for fraudulent transactions, or leveraged in follow-up attacks, such as identity theft.

Attackers using sophisticated tactics

Cofense researchers say they discovered fake websites depicting both the Immigration & Checkpoints Authority (ICA) of Singapore and the Malaysian Immigration Department.

The research found the websites are meticulously designed, featuring government logos, authentic-looking forms, navigation menus, and legitimate-looking payment gateways that are nearly identical to those nations' actual immigration portals.

The attackers were also said to continuously update the fraudulent portals in order to match any changes made on the official government pages, further enhancing their credibility.

Even more deceptive, “several parts in the fake immigration portals are already auto-filled with Personally Identifiable Information (PII) [which users can actually edit] making the page seem even more legitimate,” Cofense said.

For example, some of the partially pre-filled forms show the victim’s dates email address, mobile phone number, passport numbers, and even dates of arrival to the destination country already populated.

The researchers say that some of this information has been confirmed as legitimate, suggesting that hackers may be purchasing stolen personal data, such as passport details from the dark web.

Reports of past data breaches, including leaks of Philippines passport data, support this theory, researchers said.

Protecting Yourself

As phishing tactics become more advanced, staying vigilant is crucial.

“The dual exploitation of personal information and financial data makes this campaign particularly dangerous for victims,” Cofense says.

To avoid falling victim to this or similar immigration entry phishing scams:

• Always verify immigration-related websites by checking the official government domain.
• Be wary of urgent emails demanding immediate action, especially those requesting payment.
• Never enter personal or financial information on sites you haven’t independently verified.
• Use cybersecurity tools such as browser extensions that flag malicious sites.

As cybercriminals are constantly adapting, travelers must do the same when it comes to protecting their information.