Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation

The Hacker News reports that the threat actors behind a large-scale smishing campaign have been attributed to more than 194,000 malicious domains since 1 January 2024, targeting services worldwide, according to Palo Alto Networks Unit 42. The campaigns are linked to a China‑connected group known as the Smishing Triad, which floods mobile devices with fraudulent toll‑violation and package‑misdelivery notices to prompt immediate action and disclosure of sensitive information.

The activity is hosted primarily on popular U.S. cloud services, even though domains are registered through a Hong Kong registrar and use Chinese nameservers. Unit 42 notes that nearly 93,200 of the 136,933 root domains (68.06%) are registered under Dominet (HK) Limited, with the majority using the com prefix; 39,964 domains were active for two days or less, 71.3% for under a week, and 82.6% for two weeks or less, with less than 6% lasting beyond three months.

The analysis tallies 194,345 fully qualified domain names resolved to as many as 43,494 unique IP addresses, mostly in the U.S. and hosted on Cloudflare; the Wall Street Journal claims the group has made more than $1 billion over the last three years.