SMS Phishers Harvested Phone Numbers, Shipment Data from UPS Tracking Tool
Summary: UPS Canada told customers in a letter this month that fraudsters harvested phone numbers and shipment details from its online tracking tool to send targeted SMS phishing messages spoofing UPS and other brands, and that the exposure affected packages for a small group of shippers and some of their customers from February 1, 2022 to April 24, 2023. Recipients were addressed by name, given details of recent orders, and told to pay an added delivery fee, with one reader reporting a $1.55 demand sent to a mydeliveryfee-ups[.]info link shortly after ordering from Lego.com.
What you should know: Phishing domains tied to the campaign shared a Russian host with nearly two dozen others naming brands such as Adidas, Crocs, Apple and Telus, suggesting the attackers could query pending orders by specific retailer - and one Canadian executive received texts naming two different gift recipients less than 24 hours after ordering AirPods from Apple.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026