Scammers observed impersonating Aussie toll operator Linkt and the New Zealand Police and Ministry of Justice.
Cyber security researchers have uncovered a global smishing campaign that has sent tens of thousands of text messages posing as toll operators, transport authorities, and parking services.
According to Bitdefender research, the social engineering campaign is active in at least 12 countries, including Australia and New Zealand.
You’re out of free articles for this month
To continue reading the rest of this article, please log in.
In total, the company has observed more than 79,000 fraudulent messages spread across 40 distinct campaigns since December 2025.
The messages are delivered in multiple languages and direct victims to fake payment sites or malware loaders.
“All messages share a common goal: to persuade recipients to pay a fake fine, hand over sensitive information, or install spyware,” Bitdefender said.
“While the activity is widespread and highly coordinated, Bitdefender Labs has not attributed these scams to a specific threat actor or group.
“At this stage, there’s no confirmed link tying these campaigns together, beyond a shared theme of messages about unpaid tolls, parking violations, or traffic fines.”
The countries being targeted are the US, Canada, Australia, New Zealand, France, Spain, Colombia, Brazil, India, the UK, Ireland, and Luxembourg.
Australia: Toll scams
In Australia, the scammers are impersonating Linkt, a legitimate toll operator that operates in NSW, Victoria, and Queensland.
Bitdefender has observed malicious links hidden in more than 2,200 shortened URLs, with the sender name spoofed to be Linkt. As such, the scam messages can appear in legitimate threads.
As in many campaigns observed elsewhere in the world, the messages pressure the victims; in this case, they claim the victim needs to pay unpaid tolls or face recovery action.
“Linkt: Your toll remains unpaid. Last reminder — outstanding toll fees may escalate to
recovery action and result in rego restrictions. Pay now: https://cutt.ly/...” one message said.
New Zealand: Police and justice system
In New Zealand, however, the scammers are posing as the NZ Police and the country’s Ministry of Justice.
These messages claim to be regarding overdue traffic fines and rely upon government-themed domains to appear legitimate. The messages also include mobile-specific instructions, further lending credibility and promoting interaction.
As in Australia, the messages observed in New Zealand “warn of escalating consequences if not paid”, Bitdefender said.
“NZ Police: Your traffic fine is overdue over 10 days. Avoid late fees or court referral. Settle the payment now: https://polices-govt[.]link/nz (Please reply ‘Y’ then reopen the message to access the link).”
What to do
Bitdefender recommends that anyone who suspects they have received a scam message not click on any links, not reply to the message, check the information on the official website of the apparent sender, and delete – and report – the message.
Want to see more stories from trusted news sources?
Make Cyber Daily a preferred news source on Google.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。