Copied LuxTrust site luxtrust.support uses fake security alert to harvest credentials and bank security answers

What happened

MalwareTips reports a LuxTrust security alert scam: a copied website claims suspicious activity on the visitor's digital certificate and offers an identity check plus a callback from an 'anti-fraud assistant'. Citing Luxembourg's GOVCERT, MalwareTips says the copied site at luxtrust.support requests personal details, LuxTrust credentials and bank-account security-question answers, then promises a callback. LuxTrust is the genuine provider being impersonated. The analysis does not establish a completed call or a final payment demand.

How the scam works

The copied page says suspicious activity has been seen on the visitor's digital certificate and offers an identity check to secure it. The form then asks for personal details, LuxTrust credentials and the answers to bank security questions. Those answers are often used to confirm identity over the phone, which is why a callback from an 'anti-fraud assistant' is part of the scheme. That caller can use the stolen details to sound credible and talk the victim into approving logins or transfers.

Luxembourg's government computer emergency response team, GOVCERT.LU, has documented a series of phishing campaigns that copy trusted local services and end by asking for LuxTrust credentials. LuxTrust is the digital identity used to sign in to Luxembourg banks and government services, so those details let criminals log in as the victim, approve payments and open further fraud. Small fees, such as a few euros for a 'conversion' or 'procedure', make the request seem routine and also capture full card details.

LuxTrust is impersonated and is not involved. If you entered details, contact LuxTrust and your bank through their official websites or numbers, and don't take calls from anyone claiming to be an anti-fraud assistant.

Source

MalwareTips, "LuxTrust Security Alert Scam" (published 25 October 2026).