Loading story…
Researchers reported large-scale automated account creation activity in which attackers attempted tens of thousands of registrations in under a week and relied on a bespoke email verification pipeline rather than public disposable-email services. Investigation of the registration traffic led to attacker-controlled email domains and an associated server that exposed a misconfigured administrative panel without authentication, providing rare real-time visibility into the operators’ verification workflow (e.g., verification request volumes, success rates, worker activity, and recently processed codes).
Separate reporting tied similar mass sign-up activity to a Vietnam-based cybercrime ecosystem (tracked as O-UNC-036) that uses bots, disposable email domains, and a broader cybercrime-as-a-service marketplace to sell fraud tooling (including proxies, anti-detect browsers, and access artifacts such as session tokens). The activity is linked to downstream monetization including spam/phishing enablement and SMS pumping/IRSF, where automated sign-ups trigger premium-rate SMS charges that service providers absorb. A third report on a Canada-focused phishing campaign hosted on infrastructure allegedly linked to Iranian state-aligned activity is a different threat set and does not materially overlap with the automated sign-up/email verification story.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
By pivoting on the disposable email infrastructure, analysts discovered an exposed administrative dashboard and unauthenticated API that provided real-time visibility into the attackers' email verification operations and metrics. This revealed how the service supported automated account creation at scale.
Investigators identified unusual disposable email domains used to complete account verification and found they were part of a coordinated attacker-controlled email system. The infrastructure used centralized mail and DNS backends, polled inboxes via POP3, extracted verification codes, and exposed them through an API for bot-driven registrations.
The exposed ecosystem was found to support spam, phishing, and pig-butchering operations, while also directly monetizing through SMS pumping and International Revenue Sharing Fraud. This activity forces service providers to pay for large volumes of premium-rate SMS traffic generated through fraudulent accounts.
The report identified a Vietnam-based web design company operating CMSNT[.]co whose templates were used across many fraud storefronts. It also highlighted Via17[.]com as a marketplace selling compromised social media accounts, session tokens, and other access artifacts sourced from brute-force activity or infostealer logs.
Okta analysts and the University of Cyprus connected the activity to dozens of storefronts selling hijacked and synthetic accounts as part of a cybercrime-as-a-service marketplace. These shops also offered related fraud services such as phone farms, engagement inflation, and anti-detect tooling.
Researchers attributed the large-scale fraudulent account registration activity to a Vietnam-rooted cybercrime ecosystem tracked as O-UNC-036. The cluster was linked to infrastructure and services enabling mass production of fake identities for downstream abuse.
Analysts investigating an automated account creation attack observed more than 80,000 suspicious registration attempts in under a week, indicating a coordinated mass sign-up operation. Okta also reported waves of suspicious sign-ups tied to disposable email domains.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked a Vietnam-rooted **cybercrime-as-a-service (CaaS)** ecosystem (tracked as **O-UNC-036**) to large-scale automated creation of fraudulent online accounts used to enable downstream fraud, including spam/phishing, “pig butchering” scams, and other financially motivated abuse. The operation reportedly relies on disposable email domains, automation/bots, and a marketplace model that sells access to fraud tooling such as hijacked/synthetic accounts, session tokens, residential proxies, and anti-detect browsers; one highlighted monetization method is **SMS pumping/IRSF**, where mass fake signups trigger premium-rate SMS charges that service providers absorb. Separately, a 2026 report on **document fraud** in financial services found that **1 in 16** documents showed manipulation/fabrication/misrepresentation, and that the share of documents exhibiting both identity and financial manipulation increased from **40.2% (2024)** to **59.8% (2025)**. The report argues fraud rates are broadly similar across document types (roughly **4%–7%** for bank statements, pay stubs, and tax forms), indicating attackers are not specializing by document but instead **probing verification workflows** for the weakest control points—suggesting architectural weaknesses in verification processes rather than isolated failures of document review alone.
Jun 29, 2026
Threat actors are increasingly improving phishing success rates by abusing *trusted* channels and infrastructure rather than relying on generic lures. One observed intrusion hijacked an active executive email thread via a compromised contractor account, allowing the attacker to reply inline with a link to a Microsoft 365 lookalike login flow; analysis of detonated samples indicated use of the **EvilProxy** adversary-in-the-middle phishkit, with layered anti-bot gating (e.g., Cloudflare Turnstile) and dynamic HTML/PDF content to capture credentials without exploiting software vulnerabilities. Separately, Rapid7 documented a cloud-abuse incident where attackers used **compromised AWS credentials** to stand up phishing/spam operations using **AWS WorkMail**, leveraging Amazon’s sender reputation and sidestepping typical **SES** anti-abuse controls while generating limited, service-native telemetry that can blend into normal administrative activity. A parallel, large-scale consumer fraud operation aligned with the **“PayTool”** ecosystem was reported targeting Canadian residents through SMS-driven lures (e.g., unpaid fines) that route victims through high-fidelity impersonations of the **Government of Canada**, **Air Canada**, and **Canada Post**, including province-selection workflows designed to mimic legitimate federal-to-provincial service handoffs before directing victims to localized scam domains. In contrast, LevelBlue SpiderLabs’ write-up is broader sector telemetry on education-targeted attacks (e.g., brute force `T1110`, credential dumping `T1003`, Kerberos ticket forgery `T1558`) and does not describe the same specific phishing/fraud campaigns, though it reinforces that credential theft remains a dominant initial access path across industries.
Jun 29, 2026
A senior **U.S. Secret Service** official warned that weaknesses in the internet’s domain registration and governance model are being actively exploited to scale phishing and fraud, citing the ease with which attackers can register deceptive, brand-imitating domains and then force defenders into reactive, court-driven takedowns. The official argued that insufficient identity validation in domain registration and abuse concentration in certain networks (e.g., via **ASNs**) represent systemic gaps that enable business email compromise and link-based phishing campaigns across SMS and email. Threat intelligence reporting on Canada-linked fraud activity illustrates how these domain-registration weaknesses translate into operational campaigns: attackers are using lookalike domains, SMS lures, and paid ads to drive victims to convincing fake portals impersonating **PayBC, ServiceOntario, Canada Post, CRA, and Air Canada** to steal credentials and payment data. CloudSEK attributed much of the activity to the **“PayTool” phishing ecosystem**, describing reusable phishing kits and shared infrastructure that can be rapidly rebranded and expanded from provincial payment portals into broader “Government of Canada” themed entry points. Separate coverage of Anguilla’s `.ai` domain boom is primarily economic/industry-focused and does not provide substantive security reporting tied to the phishing and domain-abuse problem described above.
Jun 29, 2026