Introduction
Phishing campaigns targeting Dutch taxpayers are becoming increasingly sophisticated, with attackers leveraging both traditional techniques and modern third-party services to steal sensitive information.
In this research, we analyse multiple phishing pages impersonating the Belastingdienst to identify common patterns, infrastructure choices, and emerging attacker techniques. Our findings reveal not only familiar form-based data collection methods, but also a shift toward interactive, service-based phishing models. Notably, the majority of phishing activity we observed was targeting cryptocurrency, reflecting attackers’ growing focus on high-value digital assets.
Understanding these approaches is critical for improving detection and raising awareness of evolving threats.
Methodology
The research was conducted using Modat Magnify Passive DNS to identify phishing websites targeting Dutch tax-related themes.
The approach included:
- Discovery of domains impersonating the Belastingdienst
- Analysis of phishing page content and structure
- Inspection of user interaction flows
- Identification of backend communication and exfiltration mechanisms
This approach allows researchers to safely study attacker infrastructure without accessing victims’ devices or data.
Overview of Discovered Phishing Patterns
Across the identified samples, a consistent pattern emerges:
- Hundreds of phishing pages are hosted on newly registered or compromised domains.
- Interfaces convincingly mimic Belastingdienst branding to deceive users.
- Simple forms are used to collect sensitive user input.
- Submitted data is immediately sent to external services controlled by attackers.
Notably, several samples rely on Telegram as a primary data collection mechanism, without needing dedicated backend systems.
These patterns indicate a relatively low barrier to entry for attackers, who rely on readily available infrastructure and simple techniques to scale their campaigns. At the same time, the consistent use of external services for data exfiltration highlights a focus on evasion and operational simplicity.
Phishing Interface Impersonation
Example 1
This example represents a classic phishing implementation, where a spoofed Belastingdienst interface is used to collect sensitive user information through a structured web form. The page closely mimics official branding and layout, aiming to establish trust and legitimacy. Users are prompted to enter personal and financial details under the pretence of resolving a tax-related issue.
Figure 1: fake Belastingdienst “Mijn Berichtenbox” interface (source: Modat Magnify)
From a technical perspective, this approach relies on simple and widely available web technologies, requiring minimal infrastructure. Despite its simplicity, it remains effective due to its convincing visual design and straightforward interaction model. This example highlights the continued effectiveness of traditional phishing techniques, particularly when combined with strong visual impersonation.
Figure 2: fake Belastingdienst message interface, the call to action (source: Modat Magnify)
Example 2
On the other hand, we see others using MijnOverheid to target users: the platform Dutch citizens usually receive Belastingdienst communications via. In this example, the phishing page again imitates the Belastingdienst interface but differs in how collected data is handled. Instead of sending information to a dedicated backend server, the page leverages Telegram as a data exfiltration channel.
Figure 3: the MijnOverheid page (source: Modat Magnify)
These forms redirect to other pages where users can enter their information. We see that when the user submits the form, the script intercepts the action, gathers the input data, and sends it asynchronously to a server endpoint using fetch. Interestingly, the fallback endpoint is lightly obfuscated as pst1.php. The code also updates the UI by showing a loading state once the request completes (or even if it fails). The response suggests how the request was handled and whether the data was transmitted externally, notably via email and Telegram.
Figure 4: the form asking for tax information (source: Modat Magnify)
Figure 5: JavaScript behind the phishing panel
Figure 6: the data submission confirmation
Example 3
This example illustrates phishing pages and their corresponding data exfiltration workflow using Telegram. Here, the attackers have implemented a simple but highly effective infrastructure where user input from the phishing form is sent directly to a Telegram bot, bypassing the need for traditional backend servers.
The phishing interface replicates the Belastingdienst environment, presenting a convincing form for users to submit sensitive data. The page is implemented as static HTML with minimal JavaScript. This design choice allows attackers to quickly deploy multiple instances across different domains while maintaining the same look and feel. Users are guided by clear instructions and a call-to-action to submit their details, with few dynamic validation checks, maximising authenticity, simplicity and scalability.
Figure 7: phishing panel example (source: Modat Magnify)
Instead of transmitting user input to a dedicated backend server, the phishing page leverages Telegram as a data exfiltration channel. Submitted information is sent directly to a Telegram bot or channel controlled by the attacker, enabling real-time access to stolen data. The use of Telegram eliminates the need for attackers to maintain their own infrastructure while benefiting from the platform’s trusted reputation and ease of deployment, and allows attackers to manage multiple campaigns efficiently from a single interface.
Figure 8: exfiltration via Telegram
Figure 9: an example of data sent to the Telegram bot
Example 4
Unlike the other samples, this phishing page does not rely on traditional form-based data collection. Instead, it integrates a third-party live chat service (Tawk.to) to interact with victims in real time.
Users are instructed to initiate a conversation by sending a message such as “betalen” via the chat interface. This shifts the attack from a static phishing page to an interactive social engineering flow, where attackers can request sensitive information dynamically.
Figure 10: an unusual example (source: Modat Magnify)
By leveraging a legitimate service like Tawk.to, the attackers avoid maintaining their own backend infrastructure and benefit from trusted domain reputation. This also makes detection more difficult, as network traffic appears to be directed toward a legitimate platform rather than a known malicious endpoint. This example highlights a shift toward lightweight, service-based phishing techniques that prioritize flexibility and evasion over visual accuracy.
Conclusion
The analysed phishing campaigns demonstrate a clear evolution in attacker techniques. While traditional form-based data collection and Telegram exfiltration remain prevalent, newer approaches leverage legitimate third-party services such as live chat platforms to increase flexibility and evade detection. Notably, the majority of phishing activity we observed was targeting cryptocurrency.
This shift suggests that attackers are prioritising scalability and operational simplicity over perfect visual imitation. As a result, defenders must look beyond surface-level indicators and focus on behavioral patterns and infrastructure usage.
