We received a phishing SMS spoofing Bell Canada indicating that there was a billing issue. The fraudsters clumsily append an "https" to the domain and misspelled "network" but it might be good enough to fool some recipients.

When the link is clicked, a Captcha page is displayed, and when solved the recipient is presented with a fake Interac transfer page purporting to be from Bell Canada.

From the page, the recipient can choose from a number of Canadian financial institutions, and spoofed pages are displayed per bank.

No matter the choice of bank, the recipient is prompted to enter their banking details.

 IOCs:

https-bellnetwrkssl1[.]info

8.208.53[.]47

[IOC Details]