Pivoting From PayTool: Tracking Various Frauds and E-Crime Targeting Canada

**Executive Summary:** CloudSEK uncovered multiple interconnected phishing campaigns targeting Canadians—primarily the PayTool ecosystem—using SMS, typosquatting, SEO poisoning, and fake validation/payment pages to impersonate traffic-ticket portals, CRA, Canada Post, and Air Canada; the report enumerates dozens of malicious domains and IPs, profiles an actor ('theghostorder01') selling phishing kits on underground forums, assesses mass PII/financial risk, and recommends domain monitoring, DNS/web gateway blocks, public awareness, and threat-intel driven detections.