A large-scale loan phishing operation in Peru has been uncovered, showing how cybercriminals are abusing fake loan applications to steal valid card numbers and PIN codes from unsuspecting users. Active since 2024, the campaign impersonates well-known financial institutions and relies on polished social engineering to appear trustworthy from start to finish. According to new findings by Group-IB, the depth of validation built into the scam is particularly concerning. Rather than collecting data indiscriminately, the infrastructure filters out low-quality entries and focuses only on usable financial credentials. The researchers have identified at least 16 scam domains posing as a leading Peruvian bank and around 370 unique domains overall linked to the operation. Group-IB explained that the…