Smishing Triad Uncovered: 194,000+ Malicious Domains Power Global Phishing-as-a-Service Campaign

Researchers from Palo Alto Networks’ Unit 42 have uncovered a massive, fast-evolving smishing campaign tied to a threat group known as the Smishing Triad, impersonating postal, banking and government services worldwide.

Between January and September 2025, they identified 194,345 fully qualified domain names spanning 136,933 root domains, with the majority registered through a Hong Kong-based registrar, Dominet (HK) Limited, while domain registrations and nameservers sit in China and hosting infrastructure is concentrated in the United States.

The campaign began as toll violation and package misdelivery scams and now shows signs of global expansion, with victims receiving SMS messages that appear to come from familiar organisations across banking, cryptocurrency, healthcare, e-commerce, social media and law enforcement. According to Unit 42, the Smishing Triad operates a highly decentralised PhaaS ecosystem on Telegram, enabling threat actors to rotate domains, distribute kits and evade detection.

The attackers’ infrastructure combines Chinese domain registration with U.S. hosting, leveraging reputable cloud providers’ bandwidth and uptime to sustain the operation.