Monzo, one of the most popular digital banking applications in the United Kingdom, was targeted by phishing attacks since the start of 2022. The attacks start with an SMS message with multiple different calls-to-action depending on the victim. Ultimately, the text urges the user to visit a phishing webpage which collects the users email and email account credentials, Monzo PIN, name, and phone number. While this is enough to compromise a user’s email and Monzo account, the attackers leverage a special method of authentication unique to Monzo. Once the attackers can access the users email, they have Monzo send a “golden ticket” login link. This email is usually used to initially access the account before the user’s credentials are created. With this link, the attacker can log into the Monzo account without needed to enter credentials or two factor authentication. After further analysis on the phishing websites, the threat actors appeared to be using the Cazanova Morphine kit to create the landing pages. This phishing kit is one of the most advanced and professional phishing platforms sold on the dark web. The DNS records also unveiled another target, Revolut, a popular online payments service. Both domains used Chinese registrars as well as Russian IP addresses which complicates the attribution process. Users are urged to reset login details if they are believed to have clicked on these links.