Loading story…
Cybersecurity researchers have uncovered the role of specialized service providers in enabling large-scale pig butchering scams, also known as romance baiting or investment fraud, particularly in Southeast Asia. These providers, such as the Penguin Account Store (also known as Heavenly Alliance and Overseas Alliance), operate under a crimeware-as-a-service (CaaS) model, supplying turnkey scam platforms, fraud kits, stolen identities, and infrastructure that dramatically lower the barrier to entry for criminal groups. The scam operations are often run from compounds in special economic zones, where victims of human trafficking are forced to conduct fraudulent activities under threat of violence, and the infrastructure is designed to facilitate rapid laundering of stolen funds and cryptocurrencies beyond the reach of law enforcement.
The industrialization of pig butchering-as-a-service (PBaaS) has transformed the landscape of online fraud, with ready-made applications and templates now available for purchase, enabling scalable and efficient scam operations. The Penguin group exemplifies this trend, providing comprehensive packages that allow even non-technical actors to launch sophisticated social engineering campaigns. This development has contributed to the proliferation of global fraud, with law enforcement agencies and organizations like INTERPOL highlighting the intersection of cybercrime and human trafficking in these operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The same research described parked and typosquatted domains that profile visitors and redirect residential users to scam or malware content while showing benign pages to VPN users. This highlighted a broader service-provider layer supporting large-scale online fraud operations.
Infoblox detailed a Chinese-speaking 'Pig Butchering-as-a-Service' ecosystem centered on Penguin Account Store, also known as Heavenly Alliance or Overseas Alliance. The report said the operation sells stolen data, pre-registered accounts, SIMs, scam-management software, and payment services through BCD Pay to industrialize romance-baiting and investment fraud.
Infoblox said an adversary-in-the-middle phishing campaign using the Evilginx toolkit began targeting at least 18 U.S. universities on April 12, 2025. The activity was tied to 67 domains, with newer 'Evilginx Pro' capabilities making detection more difficult.
Researchers reported that a massive gambling-oriented infrastructure comprising more than 328,000 domains and subdomains has been active since at least 2011. The network was described as potentially dual-use and possibly linked to nation-state interests, using techniques such as WordPress/PHP exploitation, dangling DNS, and expired cloud assets to distribute Android malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities and researchers warned that **pig-butchering** operations have grown into a global criminal enterprise that combines online relationship and investment fraud with human trafficking. INTERPOL said victims from 66 countries had been trafficked into scam centres by March 2025, with most taken to Southeast Asia and additional activity emerging in the Middle East, West Africa, and Central America. The centres reportedly recruit workers through fake job ads, then detain and coerce them into running social-engineering scams under debt bondage and severe abuse, while criminals increasingly use AI-generated job postings, deepfake profiles, and other synthetic content to scale the fraud. The scams typically target victims on social media and messaging platforms, steering them into fraudulent cryptocurrency investments and draining funds over time. California regulators have urged consumers to recognize and report the schemes, while legal analysis in the United States found at least 81 federal civil forfeiture actions tied to pig-butchering by March 2026. Those seizures have disrupted some networks and recovered stolen crypto, but often only a small share of losses, and victim repayment remains difficult because cases depend heavily on foreign exchanges, stablecoin issuers, and complex claims processes; one exceptional case involving **Chen Zhi** and the **Prince Group** reportedly led to the seizure of about **$15 billion** in cryptocurrency.
Aug 12, 2026
Pig butchering scams, a form of crypto romance and investment fraud, are increasingly targeting victims through unconventional platforms such as matrimonial websites. Scammers exploit the high-trust environment of these platforms, engaging in prolonged, convincing conversations before introducing cryptocurrency investment opportunities. The approach is highly personalized, often involving real-time voice communication and cultural familiarity, making detection difficult for both users and platform operators. These scams are not limited to dating apps but are now leveraging the unique trust models of matrimonial services, broadening their reach and impact. Simultaneously, Chinese-speaking darknet markets hosted on Telegram, such as Tudou Guarantee and Xinbi Guarantee, have become central hubs for facilitating pig butchering operations. These markets enable billions of dollars in money laundering and provide scam-related services, including stolen data, fake investment websites, and AI deepfake tools. The scale of these operations is immense, with the FBI estimating that pig butchering scams generate around $10 billion annually from US victims alone. The convergence of social engineering tactics and robust darknet infrastructure has made pig butchering the most lucrative form of cybercrime globally.
Jun 29, 2026
Sophos reported on a Cambodia-based **pig-butchering** operation that used fraudulent online relationships and investment lures to steal money from victims. The campaign relied on scam infrastructure designed to build trust over time, then direct targets into fake cryptocurrency or investment platforms where deposits were ultimately controlled by the operators. The report highlights how the operation functioned as an organized criminal enterprise, with infrastructure, social-engineering workflows, and financial fraud mechanisms supporting the scheme. The activity underscores the continued threat from transnational scam networks that blend romance fraud, fake trading services, and cryptocurrency payment channels to extract large sums from victims while obscuring the actors behind the operation.
Jun 29, 2026