PostalScam phishing kit
PostalScam collects identity and payment details through fake redelivery, tax-payment and banking pages while an operator controls the next prompt. We have matched it on 46 sites since 22 August.
PostalScam in numbers
Since 22 August, the first PostalScam match in our records, counted on 13 October 2026. How we count.
| Sites with PostalScam code | 46 |
|---|---|
| Sites with a match in the last 30 days | 27 |
| New sites in September | 27 |
| Sites captured since 25 September | 20 |
The payment page starts an operator session
PostalScam uses fake redelivery, tax-payment and bank-rewards pages. The forms collect phone and address details, payment-card information and verification codes. The browser starts a session by requesting an API response containing a Token and a JSON configuration stored in custom.
That configuration supplies card-error text, the payment amount and operator settings under fields such as error_card_msg, pay_amount, customOp and hiddenDefaultButtons. The response also carries isBlock and isFirst state. The same token follows the visitor through the forms.
Input leaves while the visitor types
The client adds X-Token to HTTP requests and connects to a same-host WebSocket at /ws?token=[session token]. It sends a login event tagged user, then heartbeat messages keep the session open.
Field changes trigger input_text events containing the input type, field key and current text. The client also sends input updates through HTTP in its normal collection mode.
The operator chooses the next prompt
Incoming result_type messages steer the page to a card form, a code-entry page, an app-approval prompt or a success page. The handler also accepts rejection, blocking and reload instructions. Card-error text comes from the session configuration or the incoming operator message, and a rejected card returns the visitor to the card form for another entry.
The routes include /card, /otpValid, /customOtpValid and /appValid.
What we see
| Month | New sites |
|---|---|
| September | 27 |
| October so far | 10 |
Checking a PostalScam page
Keep the form scripts, session response and WebSocket messages. Look for:
- a session response with
Tokenand a JSON string incustom error_card_msg,customOp,hiddenDefaultButtonsandpay_amount- the same token in
X-Tokenheaders and/ws?token= input_textevents withtype,keyandtextfieldsloginandheartbeatevents taggeduserresult_typemessages selecting card, code or app-approval prompts
Remove the forms, session configuration and operator connection handlers. Review hosting and deployment access and rotate the credentials that placed them.