Grant Smith, S1n1st3r, continues his investigation into a sophisticated smishing campaign targeting USPS customers. In the first part, a SQL injection and a local file inclusion in a fake USPS site exposed 3,818 victim records, including card and SSN data. This time he dumped over 22,000 unique victim records and passed them to Troy Hunt for Have I Been Pwned. The phishing kit is sold by a Chinese computer science student for USDC 200 per month. Based on the handle Wangduoyu, a related article was published by Resecurity.
