Loading threat actor…
Outsider is a China-based phishing-as-a-service (PhaaS) cybercrime enterprise active since 2023 and associated with the broader Smishing Triad ecosystem. It supplies reusable phishing kits, hosted infrastructure, templates, and Telegram-mediated services to affiliated criminal groups conducting large-scale SMS phishing campaigns. Its ecosystem reportedly includes specialized developer, target-data brokerage, bulk-spamming, monetization, and coordination roles. Outsider-enabled campaigns impersonate trusted brands, government services, delivery providers, toll-payment services, financial institutions, wireless carriers, and e-commerce services. Victims are lured through urgent SMS messages and fraudulent advertisements to credential-harvesting websites. The operation has targeted individuals and businesses in the United States and numerous other countries, seeking payment-card data, banking credentials, personal information, PINs, and SMS-, email-, and app-based verification codes. The Outsider/JWR kit supports operator-assisted, real-time phishing. It captures form-field data and keystrokes as victims enter them, relays data and operator instructions through persistent web communications, and can guide targets through multi-stage verification and payment workflows. The framework supports adaptable brand skins and integrations used in e-commerce fraud, including fraudulent storefronts that redirect checkout flows to attacker-controlled payment pages. Operators rotate disposable phishing infrastructure and shortened links to complicate blocklist-based disruption. Outsider has also been reported to encourage customers to use generative-AI tools to produce or customize phishing-page code and lure content. Law-enforcement and private-sector disruption actions have targeted Outsider administrative infrastructure, phishing domains, testing storefronts, and cryptocurrency funds. Authorities have linked Outsider-enabled infrastructure to millions of compromised payment cards and substantial fraud losses.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
23 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
8 indicators attributed to this actor. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.