{"id":8228,"date":"2025-11-15T11:30:05","date_gmt":"2025-11-15T15:30:05","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=8228"},"modified":"2025-11-15T10:41:14","modified_gmt":"2025-11-15T14:41:14","slug":"large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/","title":{"rendered":"Large-scale phishing campaign poses new risk to Aruba users, investigators warn"},"content":{"rendered":"<p data-start=\"595\" data-end=\"1004\">A newly uncovered phishing operation has started circulating across Italy, and researchers say it is one of the more coordinated efforts they have seen recently. The campaign focuses on customers of <a href=\"https:\/\/hosting.aruba.it\/en\/home.aspx\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Aruba<\/a>, a major hosting and IT services provider with millions of users, and the attackers appear to be working with a toolkit designed to mimic the company\u2019s login and billing pages down to the smallest detail.<\/p>\n<p data-start=\"1006\" data-end=\"1427\">Researchers at <a href=\"https:\/\/www.group-ib.com\/blog\/uncover-phishing-italy\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Group-IB<\/a>, who examined the operation, noted that the attackers seemed intent on reaching businesses that rely heavily on Aruba\u2019s infrastructure. One researcher described the motivation quite plainly, saying that a single compromised account could place websites, domain controls, and company email at risk all at once. That kind of access makes the target \u201ca significant payoff,\u201d according to their report.<\/p>\n<p data-start=\"1429\" data-end=\"1860\">What sets this campaign apart is not only the accuracy of the impersonation but the amount of automation behind it. The phishing kit includes CAPTCHA filtering to help it slip past security checks, and it even preloads the victim\u2019s email address to make the fake page look more convincing. The attackers route the stolen data through Telegram in real time, and one researcher called the platform \u201cthe central nervous system for this entire operation.\u201d<\/p>\n<p data-start=\"1862\" data-end=\"2371\">Most victims arrive at the fake pages after receiving messages claiming their service is about to expire or that a recent payment failed. After users enter their credentials, the attackers quietly redirect them to the legitimate <a href=\"https:\/\/hostingdiscussion.com\/news\/aruba-strengthens-partnership-with-netapp-to-enhance-data-infrastructure-solutions\/\">Aruba<\/a> site, and many never notice what happened.<\/p>\n<p data-start=\"1862\" data-end=\"2371\">The attackers then push a small payment request of around five dollars, which encourages victims to enter their card details and a one-time password. That final step gives the criminals everything they need for immediate fraudulent charges.<\/p>\n<p data-start=\"2373\" data-end=\"2636\">Group-IB has not linked the activity to any known group, and Aruba has not commented publicly. For now, researchers say they cannot determine the full scale of the operation, which leaves open questions about how much money the <a href=\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/\">attackers<\/a> took and how many customers they caught off guard.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A newly uncovered phishing operation has started circulating across Italy, and researchers say it is one of the more coordinated efforts they have seen recently. The campaign focuses on customers of Aruba, a major hosting and IT services provider with millions of users, and the attackers appear to be working with a toolkit designed to [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[4946,4947,4948,4945,4944,206],"class_list":["post-8228","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-aruba-hosting","tag-credential-theft","tag-cybercrime-toolkit","tag-cybersecurity-italy","tag-phishing-attacks","tag-web-hosting"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Large-scale phishing campaign poses new risk to Aruba users, investigators warn - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Large-scale phishing campaign poses new risk to Aruba users, investigators warn - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"A newly uncovered phishing operation has started circulating across Italy, and researchers say it is one of the more coordinated efforts they have seen recently. The campaign focuses on customers of Aruba, a major hosting and IT services provider with millions of users, and the attackers appear to be working with a toolkit designed to [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-15T15:30:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-11-15T14:41:14+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/\",\"name\":\"Large-scale phishing campaign poses new risk to Aruba users, investigators warn - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2025-11-15T15:30:05+00:00\",\"dateModified\":\"2025-11-15T14:41:14+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Large-scale phishing campaign poses new risk to Aruba users, investigators warn\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Large-scale phishing campaign poses new risk to Aruba users, investigators warn - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/","og_locale":"en_US","og_type":"article","og_title":"Large-scale phishing campaign poses new risk to Aruba users, investigators warn - Web Hosting News","og_description":"A newly uncovered phishing operation has started circulating across Italy, and researchers say it is one of the more coordinated efforts they have seen recently. The campaign focuses on customers of Aruba, a major hosting and IT services provider with millions of users, and the attackers appear to be working with a toolkit designed to [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/","og_site_name":"Web Hosting News","article_published_time":"2025-11-15T15:30:05+00:00","article_modified_time":"2025-11-15T14:41:14+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/","url":"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/","name":"Large-scale phishing campaign poses new risk to Aruba users, investigators warn - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2025-11-15T15:30:05+00:00","dateModified":"2025-11-15T14:41:14+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/large-scale-phishing-campaign-poses-new-risk-to-aruba-users-investigators-warn\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Large-scale phishing campaign poses new risk to Aruba users, investigators warn"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":244,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=8228"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8228\/revisions"}],"predecessor-version":[{"id":8230,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8228\/revisions\/8230"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=8228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=8228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=8228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}