Phishing Ecosystems Using Typosquatted Domains and Kits to Impersonate Canadian Brands and Government Services

Threat actors are running large-scale impersonation and phishing operations that rely on typosquatted/cybersquatted domains, URL shorteners, and reusable phishing kits to mimic trusted brands and institutions. WhoisXML API research described Frappo, a phishing-as-a-service toolkit that enables automated brand impersonation campaigns and has been used to target major financial, e-commerce, and entertainment brands including Amazon, Netflix, and numerous North American banks.

CloudSEK reported a related pattern of industrialized fraud targeting Canada, linking significant activity to the “PayTool” phishing ecosystem that specializes in traffic violation/fine-payment scams delivered via SMS-based social engineering. The same infrastructure and design patterns were also observed impersonating PayBC, Canada Revenue Agency (CRA), Canada Post, and Air Canada, using staged “fake validation” pages (e.g., ticket numbers/booking references that accept any input) to build credibility before harvesting personal and financial data; CloudSEK also noted these campaigns and kits being commercialized on underground forums.