Loading malware…
Lighthouse is a phishing-as-a-service (PhaaS) / smishing kit associated with the Chinese-speaking, financially motivated Smishing Triad. Google and other reporting describe it as a service that enables low-skill operators to run large-scale SMS phishing and e-commerce fraud campaigns using subscription-based access, domain setup tooling, and hundreds of branded phishing templates. It has been used in scam texts and related phishing infrastructure impersonating USPS, E-ZPass and other toll services, banks, healthcare organizations, payment platforms, law enforcement, social media services, and Google properties including Google login, Gmail, YouTube, and Google Play.
Its primary function is to send high-volume smishing messages containing links to spoofed websites that harvest credentials, payment card data, banking information, and other sensitive information. Reported lure themes include unpaid toll notices, package redelivery or stuck-package messages, vehicle registration themes, and e-commerce scams. Google reporting states the operation affected more than 1 million victims across more than 120 countries. Multiple sources also state the platform rapidly rotates infrastructure and uses evasion features to reduce exposure to browser warnings and Safe Browsing detections, allowing campaigns to resume with minimal downtime.
Supporting reporting attributes core Lighthouse tooling to Wang Duo Yu. Breakglass Intelligence reported a newer Javalin/Kotlin-based kit hosted on Alibaba Cloud infrastructure, replacing previously documented PHP-based tooling. Observed infrastructure included a primary phishing server at 47.245.93.160 on Alibaba Cloud in Singapore, using nginx as a reverse proxy to a Javalin application on Jetty, Host-header-based routing for campaign selection, wildcard DNS, and automated Let's Encrypt certificate issuance. The same reporting described a WebSocket-based admin panel at /console/ and server-side exfiltration to the Telegram Bot API via api.telegram.org/bot{TOKEN}/sendMessage.
A notable reported feature is an obfuscated backdoor embedded in JQ.js distributed with kit deployments. According to Breakglass Intelligence, this backdoor exfiltrates operators' Telegram bot tokens to 102.165.14.4 (telegrambotcheck.duckdns.org) via HTTP POST to /receive_token on port 5000 with parameter referrer=loco, allowing the developer to access stolen victim data from downstream operators using the kit. The token collection server was reported as a Windows host running Python Twisted (TwistedWeb/24.3.0), with exposed services including RDP on 3389, WinRM on 5985 and 47001, and RPC on 135. A related host at 102.165.14.2 was also identified.
Observed operational characteristics include bulk domain registration through Gname.com, short-lived campaign domains typically active for 2 to 7 days, and SMS distribution via oak-tel.com, also branded Carrie SMS. Reporting also links Lighthouse to very large-scale brand impersonation activity, including tens of thousands of USPS-themed phishing sites and extensive payment-card theft. High-confidence indicators directly mentioned in the content include 47.245.93.160, 102.165.14.4, 102.165.14.2, telegrambotcheck.duckdns.org, oak-tel.com, and the Javalin servlet fingerprint io.javalin.jetty.JavalinJettyServlet-3ba0ae41.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Wang Duo Yu, the developer behind the "Lighthouse" phishing kit and the Smishing Triad's core tooling, embeds an obfuscated backdoor in the JQ.js file distributed with every kit deployment.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping Technique ID Technique Application T1583.001 Acquire Infrastructure: Domains Automated bulk registration of 61+ domains via Gname.com API
MITRE ATT&CK Mapping Technique ID Technique Application T1583.003 Acquire Infrastructure: Virtual Private Server Alibaba Cloud Singapore VPS, IPXO-leased Windows server
MITRE ATT&CK Mapping Technique ID Technique Application T1585.002 Establish Accounts: Email Accounts Singapore-based registrar accounts for domain procurement
MITRE ATT&CK Mapping Technique ID Technique Application T1608.005 Stage Capabilities: Link Target State-targeted phishing pages with multi-stage data collection
MITRE ATT&CK Mapping Technique ID Technique Application T1199 Trusted Relationship Kit author backdoor exploits trust relationship with kit operators
MITRE ATT&CK Mapping Technique ID Technique Application T1566.001 Phishing: Spearphishing Link SMS messages with malicious URLs to state-impersonating domains
You get a fake text with a link, and the link goes to a page that looks exactly like a real payment site.
a page that looks exactly like a real payment site... ready-made fake pages for USPS, E-ZPass, your bank, even Google itself
MITRE ATT&CK Mapping Technique ID Technique Application T1036.005 Masquerading: Match Legitimate Name or Location gov-*.bond domains with US state abbreviation subdomains
You type your card number to pay the 'toll'. There was never a toll. You just handed your card to a stranger.
You type your card number to pay the 'toll'. There was never a toll. You just handed your card to a stranger.
MITRE ATT&CK Mapping Technique ID Technique Application T1567.003 Exfiltration Over Web Service: Exfiltration to Cloud Storage Telegram Bot API used for real-time exfiltration of stolen data
73 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.