This threat involves a coordinated SMS phishing (smishing) campaign focused on Serbian road users, impersonating Putevi Srbije, the national road authority. The attackers send fraudulent messages claiming unpaid traffic fines, directing victims to cloned government websites to harvest payment card information. The phishing infrastructure employs JavaScript-based obfuscation techniques to avoid automated security scanners and uses numerous disposable domains with uncommon top-level domains. Technical analysis links the operation to multiple Phishing-as-a-Service platforms, specifically Darcula and Phoenix, indicating a combination of tools and roles such as infrastructure setup, SMS distribution, and data harvesting. The campaign is part of a broader trend of phishing attacks targeting government bodies, postal services, and financial institutions worldwide.

Victims risk financial loss due to theft of payment card details after interacting with the fraudulent websites. The campaign undermines trust in legitimate government communications and may lead to broader financial fraud. The use of obfuscation and disposable domains complicates detection and mitigation efforts.

No official patch or fix applies as this is a phishing campaign. Defenders should block and monitor the listed malicious domains to prevent access. Public awareness campaigns targeting Serbian road users can reduce victimization. Security teams should update spam and phishing filters to detect messages impersonating Putevi Srbije. Since this is not a software vulnerability, remediation focuses on user education and domain blocking.