Convincing Free Mobile phishing emails appear after data breach

Free Mobile, one of France’s main cellular providers, was fined €27 million by France’s data protection regulator, the CNIL, in January over failures to protect customer data. The October 2024 breach allowed an unauthorized party to access sensitive customer records, including bank account details and login information. Since the breach, we’ve seen many poorly written scam campaigns targeting Free Mobile customers. However, over the past few weeks, a well-written scam has appeared, closely copying the design of the official Free Mobile website and email templates. One of our employees, who is a Free Mobile customer, received this phishing email on Wednesday, September 30. The message used the same logo and template as legitimate emails from the company, but came from the suspicious email address freemobile-regularisation[@]knowledgegrowthcenter[.]help . It included a link that appeared to point to regularisation.free.fr : The email tells the user that an invoice of €9.99 needs to be paid to avoid having the customer’s service suspended. Clicking the link opens a redirection chain: 1. https://u2l.ai/Q5YwFz301 2. https://espace-free-mobile.pro/Ds41LE/302 3. https://espace-free-mobile.pro/Ds41LE/regularisation/?impaye=92a9e77d…200 This final domain, espace-free-mobile.pro , is hosted by Cloudflare and was registered just a month ago. The final link opens a convincing page with a form asking for credit card details: The phishing page looks authentic, which sets this campaign apart from many of the Free Mobile scams we’ve seen since the breach. We initially saw the same campaign using less convincing redirection chains, like this example from July: 1. https://bly.to/93kie5u 2. https://s1181402.ha026.t.mydomain.zone/mbl/ 3. https://s1181402.ha026.t.mydomain.zone/mbl/regularisation/?impaye=505… More recently, we’ve seen more authentic-looking domains, all hosted by Cloudflare: 1. https://s.ink/jmCnZZ 2. https://freesas.info/Cf4tP/ 3. https://freesas.info/Cf4tP/regularisation/?impaye=f13fa919d1a22833557… And another example: 1. https://bly.to/jabwpf6 2. https://regularisation-free.info/portail/ 3. https://regularisation-free.info/portail/regularisation/?impaye=83f91… How to stay safe Malwarebytes can help protect you from these threats, but treat unexpected messages about your accounts and invoices with caution: Don’t follow links in unsolicited emails. If a message concerns your account, open the official Free Mobile app or website directly, or call the official help line at 3244 . Check the actual domain in your browser’s address bar to see if it matches what you expect— https://mobile.free.fr in this case. Malwarebytes Browser Guard detects and blocks this scam directly in your browser. Use an up-to-date, real-time anti-malware solution with a web protection component on all your devices. Malwarebytes Scam Guard can help you determine whether an email is a scam and advise you on what to do next. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser → About the author Security at Malwarebytes, AdwCleaner, Privacy, Adware/PUP. 8E7F 8550 9FBD 9ED8 E68F ACB9 18E8 99E6 80C4 FF62