International Pizza Chain Domain Spoofing Report

This brief intelligence note describes an ongoing phishing campaign that targeted multiple Canada-based pizza chains (PizzaPizza, Little Caesars, Pizzaiolo, Panago, Boston Pizza) and expanded to other organizations (e.g., Oxyden). The actors used Stark Industries VPS services (Singapore and Canada), rotated servers and domains with registrations updated in 2024, and some domains currently redirect to benign sites but remain a future risk; recommended mitigations include watching for typosquatted domains, checking domain registration dates, enabling MFA, and promptly reporting shared OTPs or suspicious transactions.