Loading threat actor…
theghostorder01 is a financially motivated cybercriminal actor associated with phishing-as-a-service activity targeting Canadian users. The actor has been identified advertising and selling specialized phishing kits on underground forums, including kits themed around Ontario driver’s license renewal and other trusted Canadian government or consumer-facing services. The activity is linked to broader fraud clusters that impersonate Canadian public-sector entities and major brands, including government fine-payment workflows, postal delivery services, and airline booking services, with the objective of harvesting personally identifiable information, payment card data, and online banking credentials. The actor’s tradecraft centers on high-fidelity impersonation and credential theft. Associated phishing operations use social-engineering lures such as unpaid fines, delivery failures, booking issues, and renewal processes to drive victims into multi-step fake portals that mimic legitimate validation and payment workflows. The infrastructure and kit design support large-scale collection of financial and identity data and facilitate immediate account takeover, including theft of Interac e-Transfer credentials. Related campaigns have also used SMS-based lures, malicious advertisements, typosquatting, and SEO poisoning to attract victims. theghostorder01 appears to operate as a supplier within a commoditized phishing ecosystem rather than solely as a single intrusion operator. The actor’s offerings align with phishing kit commercialization that lowers the barrier to entry for other fraud actors. High-confidence reporting supports credential theft and initial-access enablement through phishing, as well as broader financial fraud and data exfiltration objectives. No high-confidence attribution to a nation state is available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Phishing-as-a-Service seller advertising phishing kits that mimic Canadian services (e.g., Ontario driver’s license renewal) and explicitly target banking credentials (Interac e-Transfer) to enable rapid account takeover.
Underground phishing-kit seller (PhaaS-style) advertising and selling 'scampage' source code that mimics government services and banking portals (notably Ontario driver's license renewal and Interac e-Transfer login pages). Provides buyer support via Telegram; claims multi-bank page coverage. Activity described as ongoing for ~2 years and targeting multiple geographies (UK, Canada, Australia, US).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.