AI-Enhanced Phishing Impersonates Australian Government Welfare Services

What happened

Cybercriminals deployed a large-scale phishing campaign impersonating Services Australia and Centrelink, with over 270,000 malicious emails detected in four months by Mimecast. The campaign, tracked as MCTO3001 since 2023, uses artificial intelligence to create convincing replicas of legitimate government messages targeting Australian benefit recipients.

Emails claim suspicious login attempts or account issues and direct recipients to fake myGov login pages designed to harvest credentials. Threat actors exploit legitimate email services including SendGrid, Mailgun, and Office 365, as well as compromised email accounts and the Portmap.io reverse tunnelling service to deploy phishing infrastructure.

Reported impact

The scam targets vulnerable Australians relying on government benefits including Centrelink, JobSeeker payments, Medicare, superannuation and Family Tax Benefits. Once victims enter credentials on fake login pages, attackers gain access to personal and business information.

Index analysis

Mimecast stated the campaign is one of the largest phishing campaigns detected in three years. A senior director noted that AI's role in creating grammatically perfect, perfectly formatted emails indistinguishable from official correspondence makes the scam particularly difficult to detect, as traditional warning signs like poor grammar or syntax errors are absent.

Classification

Organizations

Centrelink (victim), Services Australia (victim), Mimecast (mentioned)

Category

Fraud, scams and manipulation

Country

Australia

Harm status

Actual harm

Intent

Intentional

Timing

Unknown

Harm types

Economic or property

Harmed

Consumers, General public

Failure modes

Manipulation or dark pattern

AI systems

Unspecified AI system used for phishing email generation

Sources and evidence