Loading story…
Threat actors are scaling impersonation-driven fraud by abusing trust signals—public figures, brands, and platform distribution—to lure victims into handing over money or sensitive information. One documented operation used celebrity impersonation tailored to Canadians, selecting locally relevant public figures and using social media ad targeting (e.g., geolocation and profile-based targeting) to constrain exposure to the intended country and increase conversion; the campaign also leveraged emotionally manipulative narratives (e.g., injury/misfortune) to accelerate engagement and reduce skepticism.
In parallel, domain-based impersonation (“digital squatting”) has increased materially, with reporting citing a 68% rise over five years and WIPO recording 6,200 domain disputes in 2025. Common techniques include typosquatting, combosquatting, TLD squatting, and homograph attacks, which route users to phishing or fraudulent payment pages that mimic legitimate brands; the trend is also driving reputational harm when victims receive low-quality or nonexistent services. Recommended mitigations emphasized in reporting include proactively registering defensive domains across multiple TLDs and monitoring for lookalike domains to reduce brand impersonation risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Flare described a large-scale operation using paid social media ads, fake CBC-branded news pages, and fraudulent investment platforms to target Canadians. The campaign relied on unauthorized celebrity imagery, emotionally manipulative headlines, rotating registration pages, and extensive redirect infrastructure involving hundreds of thousands of domains.
WIPO recorded 6,200 domain disputes in 2025, described as a record level. Reporting says this total represents a 68% increase since 2020, underscoring the growth of digital squatting scams affecting businesses and brand reputation.
The Flare analysis cites 2024 estimates that global losses from online scams surpassed USD $1 trillion, while noting underreporting likely means the true impact is higher. This provides broader context for the scale of fraud ecosystems supporting impersonation and investment scams.
WIPO-referenced reporting indicates domain squatting scams increased substantially over the following five years, with 2025 levels later measured as 68% higher than in 2020. The activity included typosquatting, combosquatting, TLD squatting, and homograph attacks used to impersonate brands and steal credentials or payments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
flare.io
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly using **cybersquatting** (e.g., typosquatting, combosquatting, TLD squatting, and homograph domains) to impersonate legitimate brands and services for **credential phishing**, **malware delivery**, and fraud. Reporting cited WIPO handling a record ~6,200 domain disputes in 2025 (up 68% since 2020) and research indicating a sharp rise in malicious campaigns leveraging squatted domains, with the vast majority used to phish credentials or deliver malware; one example described impersonation of Decodo (formerly Smartproxy) via lookalike domains such as `smartproxy.org` and `smartproxy.cn`, which allegedly led to customer losses and reputational damage for the legitimate firm. Separately, incident response research described an **AI-assisted business impersonation** operation that registered **150+ domains spoofing law firms**, using multiple registrars and IP ranges, unique SSL/TLS certificates, and **Cloudflare** to conceal infrastructure. The operation appeared designed to target scam victims repeatedly (including reuse of a phone number tied to prior scam campaigns), and researchers warned that AI is lowering the barrier for less-skilled actors to run more convincing phishing/social engineering and fraud operations at higher scale.
Jun 29, 2026
A senior **U.S. Secret Service** official warned that weaknesses in the internet’s domain registration and governance model are being actively exploited to scale phishing and fraud, citing the ease with which attackers can register deceptive, brand-imitating domains and then force defenders into reactive, court-driven takedowns. The official argued that insufficient identity validation in domain registration and abuse concentration in certain networks (e.g., via **ASNs**) represent systemic gaps that enable business email compromise and link-based phishing campaigns across SMS and email. Threat intelligence reporting on Canada-linked fraud activity illustrates how these domain-registration weaknesses translate into operational campaigns: attackers are using lookalike domains, SMS lures, and paid ads to drive victims to convincing fake portals impersonating **PayBC, ServiceOntario, Canada Post, CRA, and Air Canada** to steal credentials and payment data. CloudSEK attributed much of the activity to the **“PayTool” phishing ecosystem**, describing reusable phishing kits and shared infrastructure that can be rapidly rebranded and expanded from provincial payment portals into broader “Government of Canada” themed entry points. Separate coverage of Anguilla’s `.ai` domain boom is primarily economic/industry-focused and does not provide substantive security reporting tied to the phishing and domain-abuse problem described above.
Jun 29, 2026
Threat actors are running large-scale impersonation and phishing operations that rely on **typosquatted/cybersquatted domains**, URL shorteners, and reusable phishing kits to mimic trusted brands and institutions. WhoisXML API research described **Frappo**, a phishing-as-a-service toolkit that enables automated brand impersonation campaigns and has been used to target major financial, e-commerce, and entertainment brands including **Amazon**, **Netflix**, and numerous North American banks. CloudSEK reported a related pattern of industrialized fraud targeting Canada, linking significant activity to the **“PayTool” phishing ecosystem** that specializes in traffic violation/fine-payment scams delivered via **SMS-based social engineering**. The same infrastructure and design patterns were also observed impersonating **PayBC**, **Canada Revenue Agency (CRA)**, **Canada Post**, and **Air Canada**, using staged “fake validation” pages (e.g., ticket numbers/booking references that accept any input) to build credibility before harvesting personal and financial data; CloudSEK also noted these campaigns and kits being **commercialized on underground forums**.
Jun 29, 2026