Summary
- CERT-AGID tracked 178 campaigns in its 3–9 October monitoring period.
- Of these, 143 specifically targeted Italy and 35 were broader campaigns affecting the country.
- The agency distributed 1,233 indicators of compromise to accredited organisations.
Italy’s Computer Emergency Response Team for the Agency for Digital Italy identified 178 malicious campaigns during the week from 3 to 9 October 2026, including 143 aimed specifically at Italian targets and another 35 wider operations that affected the country.
CERT-AGID published the figures on 9 October and said it had made 1,233 indicators of compromise available to accredited organisations. The figures describe campaigns observed through the agency’s own monitoring, rather than a census of every attempted cyberattack or a count of confirmed breaches in Italy.
The agency recorded 25 themes used in fraudulent messages and related delivery activity. Banking remained an important theme, featuring in 21 Italian phishing campaigns that impersonated institutions and payment services familiar to domestic customers. Among the names cited were ING, Intesa Sanpaolo, Klarna, PayPal, and several Italian financial brands.
The use of recognised financial names helps explain the appeal of these campaigns, but the brands’ appearance in a lure is not evidence that their systems were compromised. Criminals routinely impersonate trusted organisations to prompt recipients to follow links, enter credentials or open malicious content. A campaign’s claimed sender can be wholly unrelated to its real operator.
There were fewer campaigns than in the agency’s previous weekly report, which identified 219 in the 26 September–2 October period. Direct comparisons require care, however, because the monitoring window, attacker activity and the agency’s detection visibility can vary. The October figures establish what CERT-AGID observed, not a reliable prediction of underlying national cybercrime trends.
The indicators supplied to accredited entities are designed to assist operational detection and response. Depending on the campaign, indicators can include network infrastructure, files or other technical artefacts associated with observed malicious activity. Sharing them can help recipients identify known patterns, while behavioural analysis remains necessary when attackers rotate domains, accounts or malware infrastructure.
The national focus of the reporting provides an unusually concrete view of how broad fraud techniques are adapted to a local market. Attackers use language, institutional references and familiar payment brands to make phishing messages appear routine. Campaign-level monitoring captures that pattern even where individual incidents do not meet the threshold for a public breach disclosure.
The impersonation of multiple brands points to scalable identity-based deception rather than a weakness in any one bank or delivery service, and reliable attribution depends on separating the fraudulent message’s claimed identity from the infrastructure and behaviour used to deliver it.
The weekly total brings together activity with different purposes, and the accompanying indicators are not interchangeable with victims. A phishing campaign can use several related domains and messages without producing a confirmed intrusion. Conversely, a campaign that compromises a single well-positioned account could have consequences that the campaign count does not measure. The statistical categories therefore work best as a description of visible criminal activity, not as a measure of business losses.
CERT-AGID’s distinction between campaigns specifically directed at Italy and broader campaigns observed domestically also limits comparisons with global incident statistics. A message that uses Italian banking branding illustrates localisation, whereas an internationally distributed malicious attachment may be counted because it also reached Italian organisations. The agency’s intelligence supports blocking and investigation in that national context, while leaving the actual number of compromised accounts and systems unknown.
