Ing. Calogero Bono
On November 6, 2026, CSIRT Italia, the computer incident response team of the National Cybersecurity Agency, reported the return of a smishing campaign themed around SEND and PagoPA. The SMS appear to come from PagoPA services and mention an administrative fine. The link leads to a page that imitates the official one to steal personal and payment data. It matters because the message exploits the fear of a fine and targets citizens and employees alike.
A few terms before we get into the facts. Smishing is phishing via SMS, that is a fake message pushing you to click a link. SEND is the Digital Notification Service, used to deliver official documents and communications. PagoPA is the payments platform for public administration. CSIRT Italia is the group that monitors cyber threats and issues alerts. IoC stands for indicators of compromise, such as the web addresses used by attackers.
What did CSIRT Italia detect?
According to the alert AL01/261106/CSIRT-ITA, the campaign is a resurgence of an activity already reported earlier. It is a new wave of the same scheme, not a novel technique.
The stated goal is to get users to visit web resources set up to steal personal data, access credentials and information about payment instruments.
What does the fake SMS look like?
The sender appears to be linked to PagoPA services. The text refers to an alleged communication about an administrative fine and invites you to check the notice through a link in the body of the message.
It is a classic mechanism. A fine creates urgency, and urgency reduces attention. Anyone who works with company email knows the pattern, and we cover it too in phishing and email scams, how to spot them at work.
What happens if you click the link?
CSIRT explains that the victim is redirected to a page that faithfully reproduces the official graphic interface of the SEND and PagoPA services. That page was created by attackers to capture sensitive information and financial data.
The alert lists an address as an indicator, written in defanged form to prevent accidental clicks. The domain ends in .eu.cc and is not an official address.
What guidance is there for protection?
CSIRT confirms the same mitigation actions as the original alert, found in the Related section of the official page. The text of this new report does not repeat them one by one, so the full list should be checked in that document.
The problem of deceptive SMS also touches other areas of telephony, as the case of SMS of Death and the CVE-2026-58882 flaw shows, although it is a different matter.
Limits to know
The alert does not say how many people were reached, since when the SMS have been circulating, or who is behind the campaign. It also does not describe the exact text of the message, which appears only in an image. The addresses used can change quickly, so the only published indicator may not be the latest one.
What changes for those working in digital
For a business the risk is twofold. Employees can fall for the trap on a personal or company phone, and a theft of credentials or payment data can affect the company's accounts. It is worth explaining to staff that SEND and PagoPA do not ask for data through links in SMS of doubtful origin. Those who manage digital identities can also look at the IT-Wallet 1.0 regulation, useful for understanding how digital public services are changing.
Our take
This case shows that the most effective phishing is still the kind that imitates an institution and uses an anxiety-inducing theme. No sophisticated technology is needed, just a credible design. It is telling that the alert is sparse on countermeasures and refers back to an earlier document, a choice that forces the reader to search. For prevention, training and habits matter more than tools. Clear communications from public administration about how it will NEVER contact citizens are also useful.
Frequently asked questions
What is PagoPA themed smishing?
It is a campaign of fake SMS that appear to come from PagoPA. They mention an administrative fine and invite you to click a link. The link leads to a counterfeit page.
Who published the alert?
CSIRT Italia, part of the National Cybersecurity Agency. The alert is AL01/261106/CSIRT-ITA and is dated November 6, 2026.
What data are the attackers trying to steal?
Personal data, access credentials and information about payment instruments. According to CSIRT, the fake page is meant to capture sensitive information and financial data.
Is the campaign new?
No, it is a resurgence. CSIRT refers to a campaign already reported earlier, with a new wave of messages.
Where can I find the mitigation measures?
In the original alert, cited in the Related section of the official page. CSIRT confirms the same guidance without rewriting it.
What to watch as the campaign continues
Smishing campaigns come in waves and change addresses and pretexts. It is worth following official updates.
- Check the CSIRT Italia page and the original alert for the full measures.
- Watch for new versions of the alert with other indicators.
- Report suspicious SMS received by staff to internal IT so that spikes can be identified.
