Massive Lucid PhaaS Campaign: 17,500 Phishing Domains Mimic 316 Global Brands

Cybersecurity researchers have tied two sophisticated phishing campaigns to the Lucid and Lighthouse Phishing-as-a-Service platforms, revealing a massive operation that deployed over 17,500 phishing domains targeting 316 brands across 74 countries. The campaigns demonstrate the emergence of Phishing-as-a-Service platforms that operate on a subscription model, offering pre-installed templates impersonating hundreds of legitimate brands and enabling low-skilled criminals to run high-scale phishing operations.

The Lucid platform is noted for advanced evasion and anti-monitoring techniques, including conditions that must be met for malicious content to display; otherwise visitors see generic fake shops. Netcraft’s analysis reveals Lucid has been used to create phishing URLs targeting 164 brands from 63 countries, underscoring its global reach, while the Lighthouse kit—developed by WangDuoYu—offers frequent updates and two-factor credential theft capabilities at prices from $88 weekly to $1,588 annually.

The investigation also highlights connections between Lucid and Lighthouse through nearly identical anti-monitoring pages and links to Haozi group infrastructure, with Netcraft deploying targeted automation to improve detection of Lucid URLs.

According to Netcraft, the scale of the threat is reinforced by 13.5% of all phishing hostnames detected in June 2025 being powered by tracked PhaaS platforms, and overall the fight against these evolving operations remains a priority for proactive intelligence and rapid response.