Threat actors are conducting a phishing and smishing campaign that impersonates postal services to exploit the introduction of customs charges on online orders from outside the EU. The attackers send fraudulent messages to harvest payment and personal information from victims. The campaign uses malicious domains and IP addresses to deceive recipients. This is a social engineering campaign targeting Irish users, with no direct exploitation of software vulnerabilities or system compromises involved.

Victims may suffer financial fraud and identity theft due to disclosure of payment card details and personal information. This can lead to unauthorized transactions, financial loss, and privacy breaches. There is no indication of software or system compromise beyond the phishing and smishing attempts.

There is no software patch or fix since this is a social engineering campaign. Users should independently verify any customs or postal service communications, avoid clicking on links or providing payment details in unsolicited messages, and report suspicious communications to authorities. Organizations may conduct awareness campaigns about this phishing theme. Blocking the identified malicious domains (anpost.ie-sci.help, service-charge.help) and IP address (34.244.249.157) at network boundaries can reduce exposure.