The Package That Never Shipped: Following a USPS Smishing Kit Through DNS Data

Reported 13 Jun 2026 by otx · Severity: medium

A sophisticated smishing campaign impersonates United States Postal Service (USPS) package delivery notifications via SMS. The kit serves genuine USPS production HTML, CSS, fonts, and images verbatim, including live Google Analytics tags firing to USPS infrastructure. It captures