Researchers at Kaspersky have identified a targeted phishing operation aimed at Russian travelers planning trips to Europe. The scheme uses emails that impersonate the EU migration authority and demand completion of a supposed digital migration declaration five working days before entry.
The messages reference the real EES border control system to create urgency, warning of extra checks or temporary entry refusal if the form is not submitted. Recipients are then directed to a counterfeit website that features official EU symbols, polished design, and support for five languages: Russian, English, Turkish, Chinese, and Spanish.
On the fake portal, users are asked to provide personal details, travel dates, information about accompanying persons, and to upload a scan of their Schengen visa passport. The collected information enables subsequent telephone scams intended to extract money or additional sensitive data.
Experts note that the campaign may rely on address lists obtained from data leaks at hotels and booking services. The genuine EES system does not require any preliminary online registration by travelers, so any unexpected declaration requests should be verified exclusively through official consulate or visa center channels.
