The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Palo Alto Networks' Unit 42 reports on a significant smishing campaign attributed to the Smishing Triad, targeting global residents with fraudulent messages about toll violations and package misdeliveries. The campaign, ongoing since April 2024, has evolved to impersonate various international services across critical sectors, including banking, healthcare, and law enforcement. Over 194,000 malicious domains have been identified, primarily hosted on U.S. cloud services, complicating detection efforts.

The attackers employ social engineering tactics to create urgency, aiming to collect sensitive personal information. The decentralized nature of the campaign, with rapid domain churn, highlights the sophistication of the phishing-as-a-service (PhaaS) model behind it. Palo Alto Networks offers protection through Advanced URL Filtering and Advanced DNS Security to mitigate these threats.