Cloned CCSS health-card renewal site centre-cnlu.info harvests card details and LuxTrust credentials

What happened

MalwareTips reports a CCSS card renewal scam imitating Luxembourg's social security administration (Centre commun de la securite sociale). A false renewal process, starting with a math check, gradually requests personal details, payment-card information and LuxTrust credentials. Citing GOVCERT's documentation of the cloned site, MalwareTips identifies the campaign domain as centre-cnlu.info. CCSS, which is impersonated, says card renewal and dispatch are free and warns of false expiry messages by email, SMS and copied websites.

How the scam works

The cloned site begins with a simple maths check, which looks like a security step and also helps keep automated scanners away from the phishing pages. It then leads through a 'renewal' process that asks for personal details, card information and finally LuxTrust credentials. Messages pointing to it can arrive by email or SMS and say the health card is about to expire.

Luxembourg's government computer emergency response team, GOVCERT.LU, has documented a series of phishing campaigns that copy trusted local services and end by asking for LuxTrust credentials. LuxTrust is the digital identity used to sign in to Luxembourg banks and government services, so those details let criminals log in as the victim, approve payments and open further fraud. Small fees, such as a few euros for a 'conversion' or 'procedure', make the request seem routine and also capture full card details.

CCSS is impersonated and is not involved. It says card renewal and dispatch are free and warns about false expiry messages by email, SMS and copied websites. If you entered card details, block the card with your bank. If you entered LuxTrust credentials, contact LuxTrust.

Source

MalwareTips, "CCSS Card Renewal Scam" (published 25 October 2026).