Cybercriminals Exploit Canadians’ Dependence on Digital Services in Widespread Attacks

Executive Summary: A large-scale phishing campaign targeting Canadians leverages PayTool phishing-as-a-service to impersonate government services (traffic tickets, CRA), Air Canada, and Canada Post via SMS and malicious ads, using typosquatted domains, shorteners, and fallback infrastructure; researchers observed 70+ domains resolving to IP 198.23.156.130 and payment infrastructure in the 45.156.87.0/24 subnet, while threat actors sell phishing kits and coordinate via Telegram, harvesting PII and banking credentials and advising domain monitoring, DNS/web gateway controls, and public awareness campaigns as mitigations.