Loading threat actor…
Smishing Triad is a China-based, financially motivated cybercriminal ecosystem active since at least 2023 that conducts and enables large-scale mobile phishing and payment fraud. It operates as a decentralized phishing-as-a-service supply chain involving kit developers, infrastructure providers, message distributors, and fraud operators. Its campaigns target consumers worldwide, with extensive activity against United States residents and documented targeting across Europe, the Middle East, and Oceania. The ecosystem is closely associated with the Lighthouse phishing platform; Google calls the group behind that platform the Lighthouse Enterprise. Lighthouse supplies subscription-based phishing templates, site-building tools, and messaging capabilities to other criminals. Darcula is also associated with the broader ecosystem. Outsider is a separately tracked operator cluster within Smishing Triad associated with the JWR phishing kit, rather than an interchangeable name for the entire group. Campaigns distribute urgent messages through SMS, Apple iMessage, and Android RCS, commonly impersonating postal services, parcel carriers, toll authorities, government agencies, banks, and major online platforms. Typical pretexts include failed deliveries, unpaid tolls, outstanding fees, and account verification. Counterfeit websites collect personal information, payment-card details, banking credentials, passwords, PINs, and one-time authentication codes. JWR supports real-time capture of form-field changes before submission and bidirectional WebSocket communications, allowing operators to request additional authentication information and dynamically control victims’ progression through fraudulent payment workflows. Smishing Triad infrastructure relies on high-volume domain registration, deceptive brand-based naming, disposable phishing sites, and rapid infrastructure rotation. Its tooling uses localized templates and evasion mechanisms to reduce exposure to security analysis and browser warnings. Kits are marketed and supported through Telegram and other online channels. In November 2025, Google filed a civil lawsuit against 25 unnamed alleged Lighthouse operators under RICO, trademark, and computer-fraud statutes.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families Mallory has associated with this actor across public reporting.
1 additional family tracked in Mallory.
131 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.