TLDR
Cybercriminals are targeting Free Mobile customers in France with sophisticated phishing emails sent after the operator's October 2024 data breach. Messages copy the official branding and demand a small €9.99 payment to avoid service...
How it works
Cybercriminals are targeting Free Mobile customers in France with sophisticated phishing emails sent after the operator's October 2024 data breach. Messages copy the official branding and demand a small €9.99 payment to avoid service...
Red flags
- Sender domain is not Free Mobile: freemobile regularisation@knowledgegrowthcenter.help URLs chain through shorteners (u2l.ai, s.ink, bly.to) to lookalike .pro / .info sites mimicking mobile.free.fr Urgent demand for a small payment with threat of immediate service suspension What to do Never click links in unsolicited billing emails
- open the Free Mobile app or call 3244 directly Check the browser address bar and confirm the real domain is mobile.free.fr Enable real time web protection (e.g. Malwarebytes Browser Guard) and report suspicious messages to Free Mobile
What to do
- 1Red flags Sender domain is not Free Mobile: freemobile regularisation@knowledgegrowthcenter.help URLs chain through shorteners (u2l.ai, s.ink, bly.to) to lookalike .pro / .info sites mimicking mobile.free.fr Urgent demand for a small payment with threat of immediate service suspension What to do Never click links in unsolicited billing emails; open the Free Mobile app or call 3244 directly Check the browser address bar and confirm the real domain is mobile.free.fr Enable real time web protection (e.g.
- 2Malwarebytes Browser Guard) and report suspicious messages to Free Mobile
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/10/free-mobile-phishing-texts-appear-days-after-data-breachFAQ
Is Convincing Free Mobile phishing emails appear after data breach a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Sender domain is not Free Mobile: freemobile regularisation@knowledgegrowthcenter.help URLs chain through shorteners (u2l.ai, s.ink, bly.to) to lookalike .pro / .info sites mimicking mobile.free.fr Urgent demand for a small payment with threat of immediate service suspension What to do Never click links in unsolicited billing emails; open the Free Mobile app or call 3244 directly Check the browser address bar and confirm the real domain is mobile.free.fr Enable real time web protection (e.g. Malwarebytes Browser Guard) and report suspicious messages to Free Mobile
What should I do first?
Red flags Sender domain is not Free Mobile: freemobile regularisation@knowledgegrowthcenter.help URLs chain through shorteners (u2l.ai, s.ink, bly.to) to lookalike .pro / .info sites mimicking mobile.free.fr Urgent demand for a small payment with threat of immediate service suspension What to do Never click links in unsolicited billing emails; open the Free Mobile app or call 3244 directly Check the browser address bar and confirm the real domain is mobile.free.fr Enable real time web protection (e.g.; Malwarebytes Browser Guard) and report suspicious messages to Free Mobile
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.