# Turkish Banking & Government-Portal Fraud Ecosystem: 8,400+ Phishing Domains, 6,700+ e-Devlet Lookalikes, and 6,600 Monthly Social Media Scam Ads (Group-IB)

> Group-IB's Digital Risk Protection platform and CERT-GIB uncovered a coordinated Turkish fraud ecosystem spanning five interconnected schemes: bank-impersonation phishing (8,400+ domains), e-Devlet government-portal impersonation (6,700+ domains), Meta-ad-driven credential theft (6,600+ scam ads/month, 80%+ via Facebook/Instagram), fake loan and investment offers, and money-mule-based cash-out through fragmented transfers and cryptocurrency conversion. A commercial phishing kit sold for roughly $250 supports most major Turkish banks and underpins at least four campaign clusters.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1313
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-turkish-e-devlet-bank-phishing-ecosystem-tl-2026-1313.webp?v=43257f8e (Threadlinqs threat intel: Turkish e-Devlet Phishing Ecosystem: Detection & IOCs (TL-2026-1313) — High severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-1313
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Between November 2025 and April 2026, Group-IB researchers tracked a large-scale, financially motivated fraud ecosystem targeting Turkish banking customers and citizens using Turkey's e-Devlet (turkiye.gov.tr) government services portal. Rather than a single attributed actor, Group-IB characterizes the campaign as five interconnected criminal schemes operating as a coordinated value chain: victim acquisition via social media malvertising, credential theft via cloned banking/government interfaces, fraudulent loan and investment lures, government-portal impersonation for identity-document and payment-refund fraud, and money-mule-based laundering through cryptocurrency exchanges.

The core enabling technology is a commercial phishing-kit-as-a-service sold on underground channels for approximately $250, which ships templates and credential-collection panels supporting the majority of Turkish banks. At least four distinct campaign clusters were observed reusing this shared tooling, indicating a phishing-kit reseller model that lowers the technical barrier for new operators. Infrastructure is rotated roughly weekly (new domains, same templates/backend panels) specifically to outpace takedown and blocklisting.

Distribution is overwhelmingly (80%+) via Meta advertising on Facebook and Instagram. Ads are deliberately short-lived — replaced roughly every 30 minutes — defeating conventional ad-review and reporting workflows; by the time a malicious ad or landing page is reported, the operators have already rotated to new creative and infrastructure. Ad themes span fraudulent banking login pages, fake investment platforms, fake gambling sites, fraudulent consumer loan offers, and fake government-service pages.

A parallel and thematically linked vector documented by Cyble targets Turkish e-Devlet users with a phishing site (scanyalx[.]online) that harvests identity/TC kimlik credentials under a card-fee-refund pretext and then distributes an Android Remote Access Trojan (APK lures: edevletiadesistemi.apk, edevlet.apk, cimer.apk) with VNC-based remote control, keylogging, SMS interception/exfiltration, contact harvesting, and accessibility-service abuse for on-device fraud. The RAT retrieves C2 addresses indirectly via Telegram/ICQ channels rather than hardcoding them, and calls back to a2a2a2a[.]life. This RAT-based e-Devlet impersonation cluster shares the same lure theme, victim population, and government-portal-trust abuse pattern documented in the broader Group-IB ecosystem, though it is reported by a separate vendor and should be treated as an associated, thematically-linked cluster rather than confirmed common infrastructure.

Group-IB additionally documented a distinct smishing/vishing sub-scheme targeting Turkish pensioners: SMS messages impersonating e-Devlet and the Social Security Institution (SGK) promise retroactive pension supplements (e.g., a 3,000 TRY cost-of-living adjustment), driving victims to pixel-perfect cloned e-Devlet/SGK/bank login pages. Harvested TC kimlik numbers, e-Devlet passwords, and banking credentials feed automated account-takeover systems that sweep funds and submit instant consumer-loan applications in the victim's name; a second-stage vishing call impersonating police, prosecutors, or bank officials is then used to extract OTP/verification codes or coerce further transfers. Targeting is believed to be assisted by data from a prior (2023) e-Devlet-related breach. Turkey's cybercrime unit (SİBERAY) issued a public advisory on the smishing wave in June 2026.

Monetization follows a consistent money-mule model: recruitment ads offer Turkish citizens 30,000-50,000 TRY to rent out bank accounts/IBANs; stolen funds are then fragmented across 3-5 mule accounts before conversion via cryptocurrency exchanges to complicate tracing. Turkish courts have handed down sentences of up to 10 years for mule participants. Consumer complaint platform Şikayetvar recorded 23,000+ related complaints during the research window, with individual reported losses as high as $16,000.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1588.001 Malware
- T1587.001 Malware
- T1586.003 Cloud Accounts
- T1566 Phishing
- T1566.003 Spearphishing via Service
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1623.001 Unix Shell
- T1624.001 Broadcast Receivers
- T1630.001 Uninstall Malicious Application
- T1027.002 Software Packing
- T1684.001 Impersonation
- T1655 Masquerading
- T1417.001 Keylogging
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1418 Software Discovery
- T1636.003 Contact List
- T1636.004 SMS Messages
- T1513 Screen Capture
- T1119 Automated Collection
- T1102.002 Bidirectional Communication
- T1437.001 Web Protocols
- T1646 Exfiltration Over C2 Channel
- T1582 SMS Control
- T1641 Data Manipulation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Bank/e-Devlet Brand-Impersonation Page Access via Newly Registered Domain** (`TL-2026-1313-SPL-001`)

Detects proxy/web traffic to newly-registered domains serving cloned Turkish bank or e-Devlet (turkiye.gov.tr) login-page assets, matching the ~$250 commercial phishing-kit's client-side flow and confirmed IOC scanyalx[.]online.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1655, T1656
- **Data sources:** proxy, pan:threat, dns, web_gateway
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="pan:threat" OR sourcetype="squid" (uri_path="*iade*" OR uri_path="*giris*" OR uri_path="*edevlet*" OR dest_domain="scanyalx.online")
| eval domain_age_days=round((now()-strptime(whois_created,"%Y-%m-%d"))/86400,0)
| where domain_age_days<7 OR dest_domain="scanyalx.online"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as clients by dest_domain
| where count>0
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let phishDomains = dynamic(["scanyalx.online"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("iade", "giris", "edevlet") or RemoteUrl has_any (phishDomains)
| extend DomainAgeDays = datetime_diff('day', Timestamp, todatetime(WhoisCreatedDate))
| where DomainAgeDays < 7 or RemoteUrl has_any (phishDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Hits=count() by RemoteUrl
```

### Sigma

```yaml
title: Turkish Bank/e-Devlet Brand-Impersonation Domain Access
id: 8f3c1a20-1a2b-4d3e-9f10-1313001aabcd
status: experimental
description: Detects web access to newly-registered domains or the confirmed scanyalx[.]online IOC hosting cloned Turkish bank/e-Devlet login pages
references:
    - https://cyble.com/blog/the-turkish-government-masqueraded-site-distributing-android-rat/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-14
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.t1656
    - attack.t1655
logsource:
    category: proxy
    product: linux
detection:
    selection_domain:
        c-uri|contains:
            - 'scanyalx.online'
    selection_pattern:
        c-uri|contains:
            - 'iade'
            - 'giris'
            - 'edevlet'
    condition: selection_domain or selection_pattern
falsepositives:
    - Legitimate government/bank domain traffic matching generic path keywords
level: high
```

**Known false positives:**

- Legitimate banking/government portal traffic containing coincidental path keywords like 'giris' (login) or 'iade' (refund)

**Tuning notes:** Feed a live domain-age/WHOIS enrichment source (Digital Risk Protection feed) to replace the static IOC list; tighten the age threshold to match observed weekly-rotation cadence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Android RAT Sideload with Accessibility/SMS/Contacts Permission Grant (locked: unlock with TL Creds)
- On-Device Keylogging and SMS/OTP Interception via Accessibility Abuse (locked: unlock with TL Creds)
- Contact List and Screen-Capture Exfiltration Bundling Prior to Outbound Upload (locked: unlock with TL Creds)
- Indirect C2 Resolution via Messaging-App Lookup Followed by Outbound Beacon (locked: unlock with TL Creds)
- HTTP Beacon with /sk Path Pattern to Repeatedly-Rotating Low-Reputation Domains (locked: unlock with TL Creds)
- Mule-Pattern Fund Fragmentation to Newly-Opened Accounts Preceding Crypto Cash-Out (locked: unlock with TL Creds)
- Credential-Collection Panel Session Marker Written to Endpoint (locked: unlock with TL Creds)
- User Execution of Government/Bank-Themed Malicious Link or Sideloaded APK (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- Domain: `scanyalx[.]online`
- File hash: `414ea005199ba221c0048a4a7c544ae3e0891c9fe1634bbfc0cd6f3938b5f029`
- Domain: `a2a2a2a[.]life`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Turkish Banks Targeted by 8,400 Phishing Domains](https://cybersecuritynews.com/turkish-banks-targeted-by-8400-phishing-domains/)
- [8,400 Phishing Domains Targeted Turkish Banks, Group-IB Reveals](https://the420.in/turkish-banking-phishing-domains-group-ib-scam/)
- [Scammers Use 8,400 Phishing Domains to Target Turkish Banking Customers](https://cyberpress.org/scammers-use-8400-phishing-domains-to-target-turkish-banking-customers/)
- [The Turkish Government Masqueraded Site Distributing Android RAT](https://cyble.com/blog/the-turkish-government-masqueraded-site-distributing-android-rat/)
- [Turkey's Retired Millions Are Targets: How Fake e-Devlet Links Are Draining Bank Accounts](https://easternherald.com/2026/06/14/turkey-fake-e-devlet-phishing-scam-pensioners-bank-accounts/)
- [Group-IB Unites Partners to Strengthen Turkey's Cybersecurity Landscape](https://www.group-ib.com/media-center/press-releases/partners-turkey-cybersecurity/)
- [Huge set of Turkish banks' cards on sale on dark net marketplace | Group-IB](https://www.group-ib.com/media-center/press-releases/turkish-banks-cards/)
- [Deep water: exploring phishing kits | Group-IB Blog](https://www.group-ib.com/blog/phishing-kits/)
- [Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns | Group-IB Blog](https://www.group-ib.com/blog/phoenix-phaas-kit-smishing/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1313