Massive China-Linked Smishing Campaign Leveraged 194,000 Domains

Massive China-Linked Smishing Campaign Leveraged 194,000 Domains, security researchers reveal, with the campaign described as ongoing since April 2024. According to Palo Alto Networks, the operation uses over 194,000 malicious domains since 1 January 2024 and is highly decentralised, making detection harder as attackers churn through thousands of domains weekly.

The campaign impersonates toll and package delivery services, healthcare organisations, banks, cryptocurrency platforms, ecommerce and online payment platforms, law enforcement and social media platforms, with US users most targeted but a global reach. The threat actor behind the scheme is a Chinese-speaking group known as the Smishing Triad, which has been active since at least 2023, and the researchers note the group also utilised an iMessage phishing approach and a kit named Lighthouse in related activity.

Victims have been identified in countries including the UK, among others, and the campaign is described as highly decentralised with a large hosting infrastructure.