Warning – Phishing Campaign Impersonating CKB Bank

The Cybersecurity Agency warns the public of an ongoing phishing campaign in which an unknown actor is distributing malicious email messages impersonating CKB Bank.

Identified Indicators of Compromise:

• Sender address: onurs@limittrans.com
• Email subject: “Incoming Payment Draft CKB-542”

• Reverse DNS: mail3.prestijyazilim.net

The message contains a malicious attachment and is designed to make the recipient believe that it was sent by a CKB Bank employee. The aim of such messages is to trick users into opening the malicious attachment, creating a risk of malware download and execution, as well as potential compromise of devices and information systems.

Such phishing attacks may result in the theft of personal and financial information, unauthorized access to user accounts, and significant financial losses.

If you receive this or a similar suspicious message:

• Do not open attachments or click on links contained in the message.
• Do not enter or disclose personal, financial, or banking information.
• Do not reply to the message or forward it to other users.
• Report the suspicious message to the information security team responsible within your organisation.

The Agency reminds citizens and organisations to exercise particular caution when opening email messages containing attachments or requests for sensitive information. Even if a message seems to originate from a trusted institution or company, it is essential to confirm the sender’s email address and verify the authenticity of its content.