Fraudsters continue to use fake Canada Post phishing sites to entice users into entering their personal information and credit card details. In this case, the SMS message states that the recipient's package is being held and is at risk of being returned unless the recipient updates their information. The domain used contains the text "canadapost" in order to appear legitimate. When clicking the link, the recipient must first solve a Captcha before being shown the spoofed Canada Post page.

Canada Post has some resources available to help identify these types of messages.

IOCs

canadapost-myparcelfinder[.]com

162.0.231[.]155

[IOC Details]