PHISHCA

PHISHCA
Cybercriminals routinely target Canadians with phishing lures -- often via text messages (also known as "smishing") -- impersonating financial institutions, government entities, telecommunications and other companies. Their goal is to steal banking or credit card data as well as other personal identification information in order to perpetrate fraud or sell this data to other fraudsters. PHISHCA identifies and analyzes phishing threats targeting Canadians.
Victim of fraud? Report it to the Canadian Anti-fraud Centre!

Report suspicious text messages to 7726, visit Get Cyber Safe

Cybercriminals routinely target Canadians with phishing lures -- often via text messages (also known as "smishing") -- impersonating financial institutions, government entities, telecommunications and other companies. Their goal is to steal banking or credit card data as well as other personal identification information in order to perpetrate fraud or sell this data to other fraudsters.

PHISHCA identifies and analyzes phishing threats targeting Canadians.

Victim of fraud? Report it to the Canadian Anti-fraud Centre!

Report suspicious text messages to 7726, visit Get Cyber Safe

BLOG
Another Canada Post SMS Phishing Campaign
Apr 22, 2024 phish sms canadapost Fraudsters continue to use fake Canada Post phishing sites to entice users into entering their personal information and credit card details. In this case, the SMS message states that the recipient's package is being held and is at risk of being returned unless the recipient updates their information. The domain used contains the text "canadapost" in order to appear legitimate. When clicking the link, the recipient must first solve a Captcha before being shown the spoofed Canada Post page. Canada Post has some resources available to help identify these types of messages. IOCs canadapost-myparcelfinder[.]com 162.0.231[.]155
RBC / Apple Pay Phish
Apr 03, 2024 phish sms rbc apple We recently received an RBC / Apple Pay phish that directed recipients to a spoofed RBC login page. The SMS suggested that Apple Pay had been added to "Andrew's IPhone" and encouraged recipients to click the phishing link if this information was incorrect. The subdomain of the domain data-en[.]fr contains "rbc-online-banking" in an attempt to appear legitimate. IOCs rbc-online-banking.data-en[.]fr data-en[.]fr 172.64.80.1 (Cloudflare)
Netflix SMS Phishing Campaign
Mar 04, 2024 phish sms netflix A recent SMS phishing campaign spoofed Netflix and encouraged recipients to click a fake link and login to a Netflix-themed phishing page. The domain itself contains a misspelling of "netflix". When the link is clicked, the recipient is presented with a Captcha, after solving it a fake Netflix login page is shown.

	Phish URL	Date
	https://canadapost-myparcelfinder.com/	2024-04-22
	https://rbc-online-banking.data-en.fr/	2024-04-03
	https://data-en.fr/	2024-04-03
	https://myaccoun1tnetflfixssl.info/	2024-02-23