Cybercriminals Exploit Canadians’ Dependence on Digital Services in Widespread Attacks

Why It Matters

The attack demonstrates the rising profitability of low‑cost, template‑driven phishing‑as‑a‑service, threatening millions of Canadians and exposing gaps in domain monitoring and user awareness across critical public and private services.

Key Takeaways

• PayTool phishing-as-a-service targets Canadian digital services
• Over 70 spoof domains share single IP address 198.23.156.130
• Threat actor “theghostorder01” sells kits via Telegram, paid in crypto
• Typosquatting and SEO poisoning amplify Air Canada impersonations
• Recommendations: domain monitoring, block .live/.info, user education

Pulse Analysis

The surge of phishing‑as‑a‑service platforms has turned Canada’s growing reliance on online government and travel services into a lucrative attack surface. PayTool, a specialist kit that automates traffic‑violation scams, now powers a coordinated campaign that mimics the Canada Revenue Agency, Air Canada and Canada Post. By exploiting SMS alerts and short‑lived advertisements, the actors harvest personal identifiers and banking credentials at scale. This model demonstrates how low‑cost, template‑driven operations can generate high‑volume fraud without sophisticated code, underscoring a shift from bespoke malware to mass‑produced social engineering.

Behind the façade, the infrastructure is remarkably centralized. More than seventy counterfeit portals resolve to the same /24 block, notably 198.23.156.130, and a secondary subnet 45.156.87.0/24 hosts the payment‑phishing back‑ends. Domain names follow predictable patterns—ticket, traffic, portal—allowing rapid provisioning across provinces. Threat actor ‘theghostorder01’ advertises ready‑made phishing kits on Telegram, accepting USDT and Bitcoin, while buyers leverage generative AI to script data exfiltration. Typosquatted Air Canada domains such as aircanda‑booking.com benefit from SEO poisoning, capturing mistyped traffic and ad clicks. The low technical barrier accelerates the proliferation of these scams.

Defending against this wave requires a blend of technical controls and public awareness. Organizations should implement continuous domain‑watch services that flag keyword‑based typosquatting and automate takedown requests for identified IP ranges. Network security teams can block high‑risk TLDs like .live and .info at DNS and web‑gateway layers, reducing exposure to fallback domains. Equally critical is a coordinated user‑education campaign that clarifies legitimate agencies never request sensitive data via SMS links. As phishing‑as‑a‑service matures, regulators and industry groups must consider mandatory reporting and shared intelligence feeds to stay ahead of automated fraud operations.