SARS tax refund phishing: tracing a global phishing kit 

Threat researchFollowing the refund: how fake South African government sites led to a global phishing kitTwo phishing domains from VMRay UniqueSignal led to a dedicated server hosting phishing pages for multiple countries’ governments, banks and registrars.Robin Dimyanoglu External Threat Researcher / Platform Security EngineerOctober 27, 2026 · 8 min readImagine you get an SMS promisingVMRayRead More