Empty Box

Group-IB’s Digital Risk Protection team analysed delivery-themed scams impersonating SingPost and identified three distinct criminal groups that deployed smishing and phishing websites (≈140+ fake domains), fake payment gateways, a trojanized Android app that steals SMS/contacts, and real-time MITM phishing to bypass OTPs; the campaigns caused hundreds of victims and significant financial loss, and the report provides mitigation recommendations for users and brands.