Phishing-as-a-Service Uncovered: Automated Kit Impersonates Aruba S.p.A. to Steal Credentials and Credit Cards

According to Group-IB, a new, highly automated phishing framework impersonates Aruba S.p.A. to harvest credentials and credit card details, highlighting the emergence of phishing-as-a-service as a commercial ecosystem. The kit is designed as a four-stage workflow to maximise conversions and evade detection, beginning with CAPTCHA-based evasion and ending with an OTP/3D Secure interception.

Victims’ credentials are exfiltrated from a high-fidelity Aruba[.]it login replica, then redirected to the legitimate Aruba site to suppress suspicion, before a fake renewal page asks for a small fee and collects full card details. The operation relies on Telegram as a central communications and data-exfiltration channel, with stolen information delivered via multiple Telegram channels.

Aruba S.p.A. serves more than 5.4 million customers, and the attackers reportedly used convincing spear-phishing emails warning of expiring services or failed payments to lure victims. Group-IB notes that these kits are built, sold, and supported like legitimate software products, illustrating the industrialisation of online deception. The report, published on 17 November 2025, frames this as a sustained, automated supply chain rather than isolated attacks.