Loading story…
A senior U.S. Secret Service official warned that weaknesses in the internet’s domain registration and governance model are being actively exploited to scale phishing and fraud, citing the ease with which attackers can register deceptive, brand-imitating domains and then force defenders into reactive, court-driven takedowns. The official argued that insufficient identity validation in domain registration and abuse concentration in certain networks (e.g., via ASNs) represent systemic gaps that enable business email compromise and link-based phishing campaigns across SMS and email.
Threat intelligence reporting on Canada-linked fraud activity illustrates how these domain-registration weaknesses translate into operational campaigns: attackers are using lookalike domains, SMS lures, and paid ads to drive victims to convincing fake portals impersonating PayBC, ServiceOntario, Canada Post, CRA, and Air Canada to steal credentials and payment data. CloudSEK attributed much of the activity to the “PayTool” phishing ecosystem, describing reusable phishing kits and shared infrastructure that can be rapidly rebranded and expanded from provincial payment portals into broader “Government of Canada” themed entry points. Separate coverage of Anguilla’s .ai domain boom is primarily economic/industry-focused and does not provide substantive security reporting tied to the phishing and domain-abuse problem described above.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
At the 2026 Identity, Authentication and the Road Ahead Policy Forum in Washington, D.C., U.S. Secret Service official Matt Noyes said weaknesses in the domain registration ecosystem are a major, under-addressed security flaw exploited for phishing, fraudulent advertising, and business email compromise. He urged more proactive action by major internet providers and platforms to reduce abuse.
CloudSEK reported multiple fraud clusters impersonating Canadian government and commercial services, including PayBC, ServiceOntario, Canada Post, the CRA, and Air Canada. The campaigns used SMS messages, online ads, and lookalike portals to steal personal, card, and banking information, with much of the activity linked to the PayTool phishing ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberscoop.com
Open sourcecybersecuritynews.com
Open sourcespamhaus.org
Open sourcespamhaus.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are running large-scale impersonation and phishing operations that rely on **typosquatted/cybersquatted domains**, URL shorteners, and reusable phishing kits to mimic trusted brands and institutions. WhoisXML API research described **Frappo**, a phishing-as-a-service toolkit that enables automated brand impersonation campaigns and has been used to target major financial, e-commerce, and entertainment brands including **Amazon**, **Netflix**, and numerous North American banks. CloudSEK reported a related pattern of industrialized fraud targeting Canada, linking significant activity to the **“PayTool” phishing ecosystem** that specializes in traffic violation/fine-payment scams delivered via **SMS-based social engineering**. The same infrastructure and design patterns were also observed impersonating **PayBC**, **Canada Revenue Agency (CRA)**, **Canada Post**, and **Air Canada**, using staged “fake validation” pages (e.g., ticket numbers/booking references that accept any input) to build credibility before harvesting personal and financial data; CloudSEK also noted these campaigns and kits being **commercialized on underground forums**.
Jun 29, 2026
Threat actors are increasingly improving phishing success rates by abusing *trusted* channels and infrastructure rather than relying on generic lures. One observed intrusion hijacked an active executive email thread via a compromised contractor account, allowing the attacker to reply inline with a link to a Microsoft 365 lookalike login flow; analysis of detonated samples indicated use of the **EvilProxy** adversary-in-the-middle phishkit, with layered anti-bot gating (e.g., Cloudflare Turnstile) and dynamic HTML/PDF content to capture credentials without exploiting software vulnerabilities. Separately, Rapid7 documented a cloud-abuse incident where attackers used **compromised AWS credentials** to stand up phishing/spam operations using **AWS WorkMail**, leveraging Amazon’s sender reputation and sidestepping typical **SES** anti-abuse controls while generating limited, service-native telemetry that can blend into normal administrative activity. A parallel, large-scale consumer fraud operation aligned with the **“PayTool”** ecosystem was reported targeting Canadian residents through SMS-driven lures (e.g., unpaid fines) that route victims through high-fidelity impersonations of the **Government of Canada**, **Air Canada**, and **Canada Post**, including province-selection workflows designed to mimic legitimate federal-to-provincial service handoffs before directing victims to localized scam domains. In contrast, LevelBlue SpiderLabs’ write-up is broader sector telemetry on education-targeted attacks (e.g., brute force `T1110`, credential dumping `T1003`, Kerberos ticket forgery `T1558`) and does not describe the same specific phishing/fraud campaigns, though it reinforces that credential theft remains a dominant initial access path across industries.
Jun 29, 2026
Threat actors are scaling **impersonation-driven fraud** by abusing trust signals—public figures, brands, and platform distribution—to lure victims into handing over money or sensitive information. One documented operation used **celebrity impersonation** tailored to Canadians, selecting locally relevant public figures and using **social media ad targeting** (e.g., geolocation and profile-based targeting) to constrain exposure to the intended country and increase conversion; the campaign also leveraged emotionally manipulative narratives (e.g., injury/misfortune) to accelerate engagement and reduce skepticism. In parallel, **domain-based impersonation (“digital squatting”)** has increased materially, with reporting citing a **68% rise** over five years and **WIPO** recording **6,200 domain disputes in 2025**. Common techniques include `typosquatting`, `combosquatting`, `TLD squatting`, and `homograph` attacks, which route users to phishing or fraudulent payment pages that mimic legitimate brands; the trend is also driving reputational harm when victims receive low-quality or nonexistent services. Recommended mitigations emphasized in reporting include proactively registering defensive domains across multiple TLDs and monitoring for lookalike domains to reduce brand impersonation risk.
Jun 29, 2026