Phishing campaign impersonating the Canadian government shows signs of preparing German government lures
Who may be targeted: People in Canada receiving government-branded emails, and organizations in Germany that may see KBA-branded lures.
What we are seeing
A CSRF investigation mapped a phishing email impersonating the Government of Canada and Service Canada. The Canadian redirect chain is now offline, but the same GitHub account uploaded a logo belonging to Germany's Federal Motor Transport Authority (KBA) on 2026-08-07. This suggests preparation for a possible German pivot; no live German phishing page has been confirmed. CSRF reported the GitHub account to GitHub.
Warning signs
- An unexpected email claiming to be from the Government of Canada or Service Canada.
- Links that pass through redirect pages instead of going to an official government address.
Reported addresses
Written so they cannot be clicked. Do not retype them into your browser.
redirect-fa486f8e.vercel[.]appservicescanada-health.my[.]id
Source and limitations — what this alert does not establish
- The Canadian redirect chain mapped in the investigation is no longer active as of 2026-08-07.
- No live German phishing page or German victim message has been confirmed.
- The KBA logo upload indicates possible preparation but does not prove that a German campaign has launched.
- The final Canadian harvesting form was not captured.
- The GitHub account and technical clues do not establish the operator's identity, nationality, or physical location.
- The campaign may use different domains or infrastructure not yet linked to this activity.
First observed Aug 7, 2026. Published Aug 7, 2026. Published by the Cybersecurity Reach Foundation.
Send this to someone it could protect.