17,500 Phishing Domains Target 316 Brands Across 74 Countries in Global PhaaS Surge

The phishing-as-a-service (PhaaS) offerings Lighthouse and Lucid have been linked to more than 17,500 phishing domains targeting 316 brands across 74 countries. According to Netcraft, these deployments show the scale of the current PhaaS campaigns and the wide range of impersonated brands. Lucid was first documented by PRODAFT earlier this April, noting the kit’s ability to send smishing messages via Apple iMessage and Rich Communication Services (RCS) for Android.

The operation is attributed to a Chinese-speaking threat actor known as the XinXin group (changqixinyun), which has also used Lighthouse and Darcula in its campaigns; Lighthouse’s development has been linked to LARVA-241 (aka Lao Wang or Wang Duo Yu), while Darcula is linked to LARVA-246 (aka X667788X0 or xxhcvv). Netcraft notes that Lighthouse and Lucid offer template customization and real-time victim monitoring, showing how rapidly these tools are evolving within the PhaaS ecosystem.