Leaked Personal Data Turns e-Devlet #Phishing Into Personalized Financial Fraud A phishing domain surfaced via @urlyzeio reveals a multi-stage operation impersonating Türkiye’s e-Devlet portal, going significantly beyond conventional credential harvesting. It demonstrates this by combining e-Devlet credential theft, identity-data lookups, and a fabricated legal case to ultimately demand payment. Phishing domain: emaliyekontrol[.]com Analysis The operation begins by impersonating Türkiye's e-Devlet portal and several government services. Regardless of the selected service, the victim is eventually directed to a cloned e-Devlet authentication page requesting a T.C. identity number and e-Devlet password. After credentials and identity information are submitted, the phishing infrastructure appears to query an external identity-data service. An exposed configuration file reveals API endpoints for T.C. identity and address lookups. This provides the operators with a mechanism to validate or enrich information supplied by the victim before continuing the fraud. Once the victim passes this stage, the phishing site presents a completely fabricated “Dava Dosyası Sorgulama” (Court Case Inquiry) page designed to resemble an official e-Devlet/UYAP workflow. The victim is shown a personalized legal narrative containing elements such as: → Fake court case information and case numbers → Claims that the information is retrieved from UYAP → A fabricated warning regarding unpaid penalties and potential measures against bank accounts → A fake court-decision PDF populated with victim-specific information → A monetary penalty - in the observed instance, 50,000 TL → Bank account details presented as the destination for payment → Functionality for uploading the payment receipt Victims are instructed to transfer 50,000 TL to the supplied IBAN and subsequently upload the payment receipt. IBANs, beneficiary names and phone numbers should be considered rotatable campaign artifacts rather than necessarily permanent infrastructure. Receiving accounts may also be compromised, rented, or controlled by money mules. Attack chain: e-Devlet impersonation → credential harvesting → identity/address lookup → fake court case → personalized PDF → financial pressure → IBAN payment Rather than treating credential theft as the final objective, the operation uses validated personal information to make a victim-specific legal fraud scenario significantly more credible. @TRCert @malwrhunterteam @haskologlu @0x6rss