Fake Vodafone, Ooredoo sites target tourists' data

Kaspersky says it has identified a new wave of phishing sites masquerading as pages from foreign mobile operators, with tourists as the main target. Among the spoofed brands are Vodafone, Ooredoo, and The Singtel Group.

These fake pages typically ask users for a phone number, login credentials, or payment for services. According to the report, the timing matters: travelers are more likely to trust a familiar telecom brand when they need mobile service urgently and have little time to verify what they are seeing.

Researchers said one of the fake Vodafone sites was almost indistinguishable from the real account login page. If a user enters their details, that information is sent directly to scammers. If they also try to top up their balance or pay for mobile internet, their bank card details can be stolen as well.

Tatyana Kulikova of Kaspersky said the rise in these attacks is tied to criminals increasingly using AI to assemble fake pages and run ads promoting them. Similar schemes have previously been used around airline tickets, sales events, and major sports events. Now, overseas travel has been added to that list.

Recommended reading

Spy malware hides in Microsoft 365 calendars

Kaspersky’s advice is straightforward:

• check the site address character by character
• do not open attachments from suspicious emails
• set up an eSIM through the operator’s official app before departure

The report notes that major operators already offer their own apps and digital eSIM profiles, reducing the need for travelers to enter payment data on random browser pages.