Fake Shipment Tracking Scams Surge in MEA, Stealing Banking Data Through Real-Time Phishing

Group-IB observed a large-scale fake shipment tracking phishing campaign across the Middle East and Africa that uses SMS lures pointing to mobile-optimized counterfeit courier sites; the pages include embedded scripts that open WebSocket connections to exfiltrate keystrokes, including card data and OTPs, in real time. The report identifies targeted countries (notably Egypt), abused sectors (postal and financial services), attacker infrastructure patterns (disposable TLDs, shared IPs), links to the Darcula phishing-as-a-service ecosystem, and recommends user and provider mitigations such as avoiding SMS links, implementing DMARC/DKIM/SPF, and carrier-level SMS filtering.