PayTool
PayTool is a phishing and fraud threat actor/ecosystem targeting Canadians, primarily through SMS-based social engineering and traffic violation or fine-payment scams. Reporting describes the activity as an interconnected phishing ecosystem and fraud framework aligned with high-fidelity impersonation of Canadian government services and major brands, including the Government of Canada, provincial traffic/payment services, Canada Post, Air Canada, PayBC, CRA, and 407 ETR. Victims are lured with urgent themes such as unpaid fines, legal action, license suspension, failed deliveries, tax refunds, and booking issues, then directed to fake portals and payment pages designed to harvest PII, financial data, and banking credentials. Observed tradecraft includes smishing, malicious advertisements, SEO poisoning, typosquatting, URL shorteners, province-specific phishing domains, generic fallback domains for rotation when sites are blocked, and fake validation workflows that accept arbitrary values before redirecting victims to fraudulent payment gateways. Infrastructure described in reporting includes a fake “Government of Canada” or “Traffic Ticket Search Portal” experience that routes users to province-specific phishing sites, as well as Air Canada-themed typosquat sites that clone legitimate branding assets. Flare Research reported 37 scam websites associated with PayTool in the past 12 months and identified over 900 potential victims in a current campaign. CloudSEK reported over 70 canada.ca-impersonating sites on a single IP and assessed that the operation is being commercialized as phishing-as-a-service. The group’s tactics were noted as resembling those used by Chinese-speaking threat actors targeting the United States, but the provided content does not attribute PayTool to a nation state. A related underground seller alias, “theghostorder01,” was reported as marketing phishing kits aligned with this ecosystem, including kits mimicking Ontario driver’s license renewal and advertising theft of Interac e-Transfer credentials, card data, and other personal information.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- consumer
Observables
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Fraud/phishing ecosystem used to run high-fidelity impersonation campaigns (Government of Canada/provincial fine payment portals, Canada Post-style lures) primarily via smishing, with resilient domain rotation to sustain operations when domains are blocked.
Phishing/smishing ecosystem impersonating Canadian provincial/federal traffic ticket and fine-payment services (e.g., PayBC, ServiceOntario, 'Traffic Ticket Search Portal – Government of Canada') and expanding into adjacent brand-impersonation fraud (Canada Post parcel/redelivery and Air Canada booking). Uses fake validation steps followed by fraudulent payment pages to harvest PII and financial data (credit cards, Interac e-Transfer credentials). Maintains reusable templates, bulk-registered/keyword domains, and shared hosting to enable rapid rotation when domains are blocked.
PayTool is conducting large-scale SMS phishing (smishing) campaigns targeting Canadians with traffic-related scams. They impersonate government agencies and private firms to steal personal and financial information, which is then used for fraudulent purchases and currency conversion.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.