Convincing Free Mobile phishing emails appear after data breach

1. Executive summary

A phishing campaign impersonating the French mobile operator Free Mobile is delivering well-crafted emails that copy the operator's logo and email template, then route victims through multi-hop redirect chains to a fake payment page that harvests credit card details. The campaign follows an October 2024 breach of Free Mobile customer records that exposed bank account details and login information, and a January CNIL fine of €27 million against the operator over data protection failures. The targeting is consumer-facing and French, so direct exposure to EMEA financial services firms is limited, but the card data captured at the fake payment page will surface in card-not-present fraud and the redirect infrastructure is reusable against any brand. No CVE, no CISA KEV entry and no tracked threat actor is associated with this activity in the source material.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The activity described is consumer phishing against a telecoms operator's customers, not an ICT incident affecting a financial entity's own network or a third-party provider in its supply chain. The one point worth noting for firms that process card payments is downstream: card data captured by the fake payment page will appear as fraud on issuing portfolios, which is handled under existing fraud and chargeback processes rather than the incident-reporting articles below.

3. Technical analysis & attack chain

The campaign is a credential and card-harvesting phishing operation. The source does not name a threat actor, does not attribute the activity to the October 2024 Free Mobile breach, and provides no malware, no CVE and no exploitation of a software vulnerability. The chain below reflects the steps confirmed in the source.

1. A phishing email is sent to a Free Mobile customer. The message reproduces the Free Mobile logo and email template. In the observed sample the sender address was freemobile-regularisation[@]knowledgegrowthcenter[.]help, and the visible link text pointed at regularisation.free.fr while the underlying link resolved elsewhere.
2. The email claims an invoice of €9.99 is unpaid and that the customer's service will be suspended unless payment is made. This is a payment-fraud pretext, not an account-takeover pretext.
3. Clicking the link opens a three-hop redirect chain. In the September 30 sample: hxxps://u2l.ai/Q5YwFz301, then hxxps://espace-free-mobile[.]pro/Ds41LE/302, then hxxps://espace-free-mobile[.]pro/Ds41LE/regularisation/?impaye=92a9e77d...200. The first hop is a link-shortening or redirect service; the second and third hops sit on the same attacker-controlled domain.
4. The final URL loads a page that copies the Free Mobile site design and presents a form requesting credit card details. The source describes the page as authentic-looking and states this is what distinguishes the campaign from earlier, cruder Free Mobile scams seen since the breach.
5. Card details submitted to the form are captured by the operator of the phishing page. The source does not describe what happens to the captured data, whether it is sold, used for card-not-present fraud, or resold to other actors.

Infrastructure detail. The final domain in the September 30 sample, espace-free-mobile[.]pro, is hosted by Cloudflare and was registered about a month before the email was received. The source notes that the more recent domains in this campaign are all Cloudflare-hosted. The redirect chains use a mix of shortener services (u2l.ai, bly.to, s.ink) and attacker-registered domains.

Earlier iterations of the same campaign, observed in July, used less convincing infrastructure: hxxps://bly.to/93kie5u, then hxxps://s1181402[.]ha026[.]t[.]mydomain[.]zone/mbl/, then hxxps://s1181402[.]ha026[.]t[.]mydomain[.]zone/mbl/regularisation/?impaye=505... The source gives two further recent examples: hxxps://s.ink/jmCnZZ, hxxps://freesas[.]info/Cf4tP/, hxxps://freesas[.]info/Cf4tP/regularisation/?impaye=f13fa919d1a22833557...; and hxxps://bly.to/jabwpf6, hxxps://regularisation-free[.]info/portail/, hxxps://regularisation-free[.]info/portail/regularisation/?impaye=83f91...

The common path structure across samples is /regularisation/ followed by a query string carrying an impaye (unpaid) parameter with a long hexadecimal value. That parameter is the most stable artefact across the campaign and is the strongest single detection anchor.

Confidence caveats. This advisory rests on a single source, the Malwarebytes blog post of 2026-10-01. The redirect chains, sender address and domain registration detail are single-sourced and should be verified before any enforcement action. The link between the phishing campaign and the October 2024 Free Mobile breach is temporal only: the source states the scams appeared since the breach but does not present evidence that the breach data was used to select or target recipients. Treat that connection as unconfirmed. No threat actor is named, and no MITRE ATT&CK profile is available for this activity.

4. Mitigation & containment

The primary exposure here is consumer card data, not enterprise infrastructure. The actions below are ordered for a financial services firm whose customers or staff may be targeted, or whose card portfolios will absorb the fraud.

P1 (within 24 hours)

• Block the confirmed phishing domains at the web proxy, DNS resolver and secure email gateway: espace-free-mobile[.]pro, freesas[.]info, regularisation-free[.]info, and the subdomain s1181402[.]ha026[.]t[.]mydomain[.]zone. These are single-sourced; verify against your own telemetry before a permanent block.
• Add the sender address freemobile-regularisation[@]knowledgegrowthcenter[.]help to email gateway blocklists and search mail logs for any inbound or outbound mail from that address.
• If you issue cards in France, brief the fraud team that a Free Mobile-branded phishing page is harvesting card details and expect card-not-present attempts against affected BINs. No specific BIN range is given in the source.
• Search web proxy logs for the shortener hops (u2l.ai, bly.to, s.ink) carrying the paths shown in §3, and for any URL containing /regularisation/ with an impaye= parameter.

P2 (within 72 hours)

• Push a staff awareness note covering the pretext: an unpaid invoice of €9.99 and a threat of service suspension. Tell staff that legitimate Free Mobile account actions are taken in the official app or at mobile.free.fr, and that the official help line is 3244.
• Add the /regularisation/?impaye= path pattern to any URL-reputation or browser-protection control you run, since the campaign rotates domains but keeps the path.
• Where you operate a customer-facing payment flow, confirm that your own payment pages are reached only from your own domains and that customers are not conditioned to follow invoice links from email.

P3 (within 7 days)

• Review whether your brand is being impersonated with the same template-and-redirect pattern. The infrastructure is brand-agnostic; the same shortener and Cloudflare-hosted domain pattern can be pointed at a bank.
• Feed the domains and the sender address into your takedown and brand-protection process. The source notes Cloudflare hosting, so abuse reports go to Cloudflare plus the relevant registrar.

No vendor patch applies. This is not a software vulnerability and there is no fixed version to move to.

5. Indicators of compromise

All indicators below are single-sourced from the Malwarebytes blog post. Verify before enforcement.

The impaye parameter values in the source are truncated with ellipses. They are reproduced here only as far as the source gives them and should not be treated as complete values.

email  freemobile-regularisation[@]knowledgegrowthcenter[.]help
domain  espace-free-mobile[.]pro
domain  freesas[.]info
domain  regularisation-free[.]info
domain  s1181402[.]ha026[.]t[.]mydomain[.]zone
url  hxxps://u2l.ai/Q5YwFz301
url  hxxps://espace-free-mobile[.]pro/Ds41LE/302
url  hxxps://espace-free-mobile[.]pro/Ds41LE/regularisation/?impaye=92a9e77d
url  hxxps://bly.to/93kie5u
url  hxxps://s1181402[.]ha026[.]t[.]mydomain[.]zone/mbl/
url  hxxps://s1181402[.]ha026[.]t[.]mydomain[.]zone/mbl/regularisation/?impaye=505
url  hxxps://s.ink/jmCnZZ
url  hxxps://freesas[.]info/Cf4tP/
url  hxxps://freesas[.]info/Cf4tP/regularisation/?impaye=f13fa919d1a22833557
url  hxxps://bly.to/jabwpf6
url  hxxps://regularisation-free[.]info/portail/
url  hxxps://regularisation-free[.]info/portail/regularisation/?impaye=83f91

Behavioural indicators

6. Detection

The campaign's stable artefacts are the redirect path structure and the impaye parameter. The YARA rule below targets the phishing page content and URL structure; the Sigma rule targets the network and email behaviour.

rule Phish_FreeMobile_Regularisation_Page
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-02"
        reference = "https://www.malwarebytes.com/blog/threat-intel/2026/10/revolut-phishing-texts-appear-days-after-data-breach-clone"
        description = "Detects Free Mobile regularisation phishing pages and redirect URLs from the campaign observed after the October 2024 Free Mobile breach"
    strings:
        $path1 = "/regularisation/" ascii nocase
        $path2 = "/portail/regularisation/" ascii nocase
        $param = "impaye=" ascii nocase
        $dom1 = "espace-free-mobile.pro" ascii nocase
        $dom2 = "freesas.info" ascii nocase
        $dom3 = "regularisation-free.info" ascii nocase
        $dom4 = "mydomain.zone" ascii nocase
        $brand = "Free Mobile" ascii nocase
    condition:
        uint16(0) == 0x3C3F or uint16(0) == 0x6874 or filesize < 2MB
        and (
            (any of ($dom*))
            or (any of ($path*) and $param)
            or ($brand and $param)
        )
}

title: Free Mobile regularisation phishing redirect and payment page access
id: 8f2c1a44-5b7e-4d19-9c3a-2e6f0b7d1a55
status: experimental
description: Detects HTTP requests to the Free Mobile regularisation phishing redirect chains and payment pages observed in the campaign following the October 2024 Free Mobile breach
author: Adverse Trace
date: 2026-10-02
references:

    - https://www.malwarebytes.com/blog/threat-intel/2026/10/revolut-phishing-texts-appear-days-after-data-breach-clone
logsource:
    category: proxy
detection:
    selection_path:
        cs-uri-path|contains:

            - '/regularisation/'
            - '/portail/regularisation/'
    selection_param:
        cs-uri-query|contains: 'impaye='
    selection_domain:
        cs-host|endswith:

            - 'espace-free-mobile.pro'
            - 'freesas.info'
            - 'regularisation-free.info'
            - 'mydomain.zone'
    condition: selection_domain or (selection_path and selection_param)
falsepositives:

    - Legitimate Free Mobile regularisation pages hosted on free.fr domains, which do not match the cs-host list
level: high

A second Sigma rule for the email gateway, keyed on the sender address and the invoice pretext, is not included because the sender address is a single observed sample and the pretext wording is not quoted verbatim in the source. Blocking the sender address in §4 is the appropriate control until more samples are available.

7. Sources

• Malwarebytes, "Convincing Free Mobile phishing emails appear after data breach", https://www.malwarebytes.com/blog/threat-intel/2026/10/revolut-phishing-texts-appear-days-after-data-breach-clone, published 2026-10-01.

8. Adverse Trace position

Adverse Trace assesses this as a consumer phishing campaign with low direct impact on EMEA financial services infrastructure and moderate downstream impact on card-issuing fraud teams. There is no CVE, no CISA KEV entry and no named threat actor in the source material, so no vulnerability-management or actor-tracking action follows from it. The entire advisory rests on one vendor blog post; the redirect chains, sender address and domain registration detail are single-sourced and we have flagged them as such throughout. We will monitor for additional samples that confirm the /regularisation/?impaye= path pattern and for any indication that the same infrastructure is being retargeted at financial brands, and we will issue a follow-up if the campaign broadens beyond Free Mobile or if a second source corroborates the infrastructure. Clients who issue cards in France should treat the domain list in §5 as a starting blocklist and expect card-not-present attempts against affected portfolios.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.