Fake shipment tracking SMS phishing campaign
Campaign
Summary
Hide ▲
Show ▼
A global surge in fake shipment tracking phishing campaigns is stealing funds and credentials at scale, with activity rising from almost none in 2024 to over 100 campaigns a month in 2025. The scams use SMS phishing, sender ID spoofing, and fake tracking sites to impersonate parcel delivery services. Some of the activity overlaps with Darcula, a Chinese-language PhaaS platform used in over 100 countries. Victims who follow the prompts to update details or pay small fees are pushed into pages that collect personal and financial information.
Related Happenings
Ghost Stadium FIFA World Cup fraud campaign
Campaign
First: 27.05.2026 14:28
Last: 27.05.2026 14:28
Sources 1
About this happening:
A **Ghost Stadium** fraud campaign has registered **4,300+ FIFA lookalike domains** and is using **paid Facebook ads** to funnel **2026 FIFA World Cup** fans into phishing and tic...
Ghost Stadium FIFA World Cup fraud campaign
CampaignAbout this happening: A **Ghost Stadium** fraud campaign has registered **4,300+ FIFA lookalike domains** and is using **paid Facebook ads** to funnel **2026 FIFA World Cup** fans into phishing and tic...
Phantom Stealer Europe phishing campaign
Campaign
First: 31.03.2026 17:00
Last: 31.03.2026 17:00
Sources 1
About this happening:
A **sustained phishing campaign** delivered **Phantom Stealer** to organizations in **logistics, manufacturing and technology** across **Europe**, creating a broad credential-thef...
Phantom Stealer Europe phishing campaign
CampaignAbout this happening: A **sustained phishing campaign** delivered **Phantom Stealer** to organizations in **logistics, manufacturing and technology** across **Europe**, creating a broad credential-thef...
Ongoing Dropbox credential-theft phishing campaign
Campaign
First: 03.02.2026 12:55
Last: 03.02.2026 12:55
Sources 1
About this happening:
An **ongoing phishing campaign** is stealing **Dropbox credentials** from corporate users and can enable **account takeover** and follow-on fraud. The operation uses **urgent-busi...
Ongoing Dropbox credential-theft phishing campaign
CampaignAbout this happening: An **ongoing phishing campaign** is stealing **Dropbox credentials** from corporate users and can enable **account takeover** and follow-on fraud. The operation uses **urgent-busi...
Peru loan phishing campaign impersonating financial institutions across Latin America
Campaign
First: 21.01.2026 17:00
Last: 21.01.2026 17:00
Sources 1
About this happening:
A **Peru-focused loan phishing campaign** has expanded across **Latin America**, putting users' **card numbers**, **PIN codes**, and **banking credentials** at risk. The operation...
Peru loan phishing campaign impersonating financial institutions across Latin America
CampaignAbout this happening: A **Peru-focused loan phishing campaign** has expanded across **Latin America**, putting users' **card numbers**, **PIN codes**, and **banking credentials** at risk. The operation...
STAC6565 spear-phishing campaign targeting Canadian organizations
Campaign
First: 09.12.2025 11:35
Last: 09.12.2025 11:35
Sources 1
About this happening:
The **STAC6565** campaign has driven **almost 40 intrusions** against **Canadian organizations**, making it a sustained operation with a sharply focused target set. Attackers use...
STAC6565 spear-phishing campaign targeting Canadian organizations
CampaignAbout this happening: The **STAC6565** campaign has driven **almost 40 intrusions** against **Canadian organizations**, making it a sustained operation with a sharply focused target set. Attackers use...
Timeline
-
16.03.2026 16:45 2 articles · 2mo ago
Global fake shipment tracking phishing surge disclosed
Initial DisclosureGroup-IB described a global surge in fake shipment tracking phishing campaigns that abuse parcel delivery messages, lookalike domains, sender ID spoofing, and fake tracking pages to steal credentials and funds from parcel delivery customers; the researchers said the activity rose sharply through 2025, with over 100 campaigns almost every month and peaks in June and December 2025, and noted that some sites shared infrastructure commonly associated with Darcula.
Show sources
- Researchers Warn of Global Surge in Fake Shipment Tracking Scams — www.infosecurity-magazine.com — 16.03.2026 16:45
- Researchers Warn of Global Surge in Fake Shipment Tracking Scams — www.infosecurity-magazine.com — 16.03.2026 16:45