# Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow

> A phishing campaign impersonating Australia's myGov portal and the Australian Taxation Office (ATO) uses a fake 'secure message' email lure sent from workspace@sasinm.com to drive victims through a seven-step web flow that harvests credentials, three separate SMS one-time codes, security question answers, full name/DOB, and front/back driver's license photos, before redirecting to the real myGov site with a fake tax-statement confirmation.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2556
- **ID:** TL-2026-2556
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 3 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MailGuard identified and analyzed a phishing campaign that spoofs Australia's myGov citizen-services portal and the Australian Taxation Office (ATO). The lure is an email with the display name 'myGov' sent from the address workspace@sasinm.com, subject 'You have (1) New Message', claiming the recipient has '1 New MyGov Notification' and '1 new secure message(s)' waiting, styled with Australian Government/ATO branding and language about a secure link.

Clicking through leads to a fake myGov website that runs the victim through a seven-stage progressive data-harvesting flow rather than a single credential form: (1) username/email and password, on a page mimicking the genuine myGov login complete with 'Forgot username'/'Forgot password' links; (2) a first SMS one-time verification code via a labeled 'Code' field; (3) answers to three user-selected security questions via dropdown selections; (4) full name and date of birth (dd/mm/yyyy); (5) a second SMS code via a repeat 'Enter Code' page; (6) front and back photos of the victim's driver's license via a 'Drivers License' upload interface with separate 'Browse' buttons; (7) a third SMS code via a final 'Enter Code' page. Prompting for three separate SMS codes at different points in the flow, interleaved with credential and PII collection, is consistent with a real-time credential-relay/adversary-in-the-middle kit that forwards stolen username/password and OTP to the genuine myGov login in order to capture an authenticated session, a pattern documented across the broader 2026 Australian myGov phishing wave and explicitly described by independent researchers as a 'reverse-proxy or credential-relay [that] forwards both factors to the real my.gov.au and captures the authenticated session' (credential-relay kits observed by other researchers achieving account takeover within 5-30 minutes of harvest).

After the seventh step, the page displays a fake confirmation reading 'Your details has successfully been submitted, please wait 21 days for your income statement to be tax ready' and redirects the victim to the legitimate my.gov.au site, a technique designed to suppress suspicion by ending the interaction on a real, trusted domain.

The combination of full credentials, live MFA/OTP interception, security-question answers, DOB/PII, and government photo-ID capture goes beyond simple account takeover: it supplies everything needed for synthetic-identity fraud, fraudulent tax-return filing, and redirection of Centrelink/ATO payments. This matches the 'Identity re-verification' template documented as one of four rotating myGov-impersonation templates driving the highest-volume government-impersonation phishing wave hitting Australian inboxes in 2026, per independent 2026 reporting. It also continues a documented lineage of MailGuard-tracked multi-stage myGov/ATO credential-harvesting kits: a May 2025 MailGuard campaign ('Multi-Stage Super Scam Mimics myGov to Harvest Credentials') used a 10-stage flow from a different sender (mnadeau@pshift.com, subject 'Action Required Under Section 12B – Personal Records Audit') landing on pazenesaction.org.es, harvesting myGov credentials, 2FA SMS codes, name/DOB/driver's-license/Medicare/TFN details, an ID-document selfie, and superannuation-fund login credentials, before also redirecting to the genuine myGov site — the same operational template (progressive multi-step harvest ending in a real-domain redirect) as this campaign, differing mainly in step count and the addition of the driver's-license-photo-upload step in this variant. The MailGuard source article for this specific threat discloses no threat-actor attribution and no additional infrastructure beyond the sasinm.com sending domain, and BeaconBeagle returned no C2 infrastructure correlation for that domain.

## MITRE ATT&CK

- T1598.003 Phishing for Information: Spearphishing Link
- T1583.001 Acquire Infrastructure: Domains
- T1585.002 Establish Accounts: Email Accounts
- T1608.005 Stage Capabilities: Link Target
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1684.001 Impersonation
- T1036 Masquerading
- T1111 Multi-Factor Authentication Interception
- T1557 Adversary-in-the-Middle
- T1056.003 Input Capture: Web Portal Capture

## Sources

- [Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow](https://www.mailguard.com.au/blog/fake-mygov-secure-message-phishing-scam-targets-australians-with-multi-step-identity-harvesting-flow)
- [Australian Taxation Office (ATO) and 'myGov' impersonation scams](https://www.scamwatch.gov.au/about-us/news-and-alerts/australian-taxation-office-ato-and-mygov-impersonation-scams)
- [The myGov Scam Costing Australians Thousands](https://intrusionx.com.au/blog/mygov-scam-australia-2026-how-to-spot-avoid/)
- [myGov 'account locked' scam Australia: how to spot the Medicare, Centrelink and ATO phishing wave in 2026](https://safebrowz.com/blog/mygov-account-locked-scam-australia)
- [Aussies urged to beware of myGov email phishing scam](https://www.govtechreview.com.au/content/gov-security/news/aussies-urged-to-beware-of-mygov-email-phishing-scam-361853151)
- [Multi-Stage Super Scam Mimics myGov to Harvest Credentials](https://www.mailguard.com.au/blog/multi-stage-super-scam-mimics-mygov-to-harvest-credentials)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2556