The “PayTool” Trap: Massive Fraud Cluster Impersonates Canada Gov & Air Canada

**Executive summary:** CloudSEK uncovered a large, coordinated PayTool-linked fraud campaign targeting Canadian citizens with high-fidelity impersonations of federal services and commercial brands (e.g., Air Canada), leveraging smishing, SEO poisoning, typosquatting, province-specific phishing portals, and rotating fallback domains; the operation is being commoditized via Phishing-as-a-Service and active sellers advertising kits that harvest banking credentials and other high-value data.