Loading story…
Google Cloud's Mandiant Threat Intelligence reported the continued evolution of Chinese-language phishing services, describing an ecosystem that lowers the barrier to entry for financially motivated and espionage-linked cyber activity. The services reportedly provide ready-made phishing kits, credential-harvesting infrastructure, and operational support tailored to Chinese-speaking users, enabling attackers to rapidly launch campaigns against a range of online services and organizations.
The report indicates that these offerings function as a commercialized underground market, with operators advertising turnkey capabilities that can streamline account theft, fraud, and follow-on intrusions. Mandiant said the growth of these Chinese-language phishing services reflects increasing specialization in the cybercrime supply chain, where phishing infrastructure, lures, and support are packaged as services that can be reused across multiple campaigns.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Google Cloud's Mandiant Threat Intelligence blog published a report titled "The Evolution of Chinese-language Phishing Services," documenting the topic publicly. No earlier event details are available in the provided reference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly adopting a subscription-based model, offering a wide range of crime-as-a-service (CaaS) tools and infrastructure that lower the barrier to entry for less skilled attackers. Services such as phishing-as-a-service (PhaaS) now provide turnkey solutions, including AI-powered tools like SpamGPT for generating convincing phishing emails and malicious document builders like MatrixPDF, all available for recurring fees. These platforms offer features such as customer support and user guides, making sophisticated attacks accessible to a broader audience. The ecosystem also includes the resale of compromised accounts and access, further fueling the underground economy. Recent campaigns demonstrate the effectiveness and evolution of these services. For example, a targeted phishing operation used fake Calendly invites impersonating over 75 major brands to steal Google Workspace and Facebook business credentials, leveraging AI to craft highly convincing lures. Compromised ad manager accounts are then used for malvertising, malware distribution, and further phishing. Meanwhile, advanced adversary-in-the-middle (AiTM) frameworks like Evilginx are being deployed in attacks against educational institutions, bypassing multi-factor authentication and evading traditional detection methods. These developments highlight the growing sophistication and commercialization of cybercrime, with attackers exploiting both technical innovation and social engineering at scale.
Jun 29, 2026
Researchers have identified a large-scale, decentralized phishing campaign known as Smishing Triad, which leverages SMS messages to impersonate services across critical sectors including banking, e-commerce, healthcare, law enforcement, and social media. The operation, managed in Chinese and supported by a network of thousands of malicious actors, has registered nearly 195,000 domains since January 2024, primarily through a Hong Kong-based registrar and using Chinese DNS infrastructure, but with most attack domains hosted on U.S.-based cloud services. The campaign targets victims globally, with a notable focus on U.S. residents, and uses sophisticated social engineering tactics to collect sensitive information such as national identification numbers, home addresses, financial details, and credentials. The Smishing Triad campaign is highly decentralized, involving a range of specialists including data brokers, domain sellers, phishing kit developers, and spammers who deliver lures via mobile messaging apps. The group’s infrastructure and phishing kits are also used by other threat actors, further expanding its reach. The campaign’s scale, complexity, and use of phishing-as-a-service (PhaaS) models make it a significant and evolving threat, with attackers continuously adapting their tactics and expanding the range of impersonated services to maximize the effectiveness of their phishing operations.
Jun 29, 2026
Multiple reports highlight **social engineering-driven compromise** rather than exploitation of software vulnerabilities, with attackers relying on trusted-looking communications and infrastructure to bypass defenses. One campaign described by X-Labs uses a “clean” initial business email (often passing `SPF`/`DKIM`/`DMARC`) that contains **no direct malicious link**, instead delivering a **PDF attachment** that leads victims through a multi-stage document chain. The chain leverages reputable cloud services—including **Vercel Blob**—to host intermediary PDFs that redirect to a **Dropbox-impersonation** credential-harvesting page, and then uses a **Telegram bot** as a collection point for stolen credentials, complicating detection and takedown. Separately, researchers reported a targeted operation attributed to **China-linked Mustang Panda** (aka *HoneyMyte*) against government officials and diplomats, using **fake diplomatic briefing documents** themed as U.S./international policy updates to induce execution and install surveillance tooling, including **PlugX** (noted as a DOPLUGS variant). In parallel, U.S. reporting described **HUMINT-style recruitment approaches** tied primarily to China, where adversaries pose as recruiters/consulting firms on email and job platforms to elicit or purchase sensitive information from current/former U.S. government personnel—an espionage pathway that is adjacent to, but distinct from, the phishing/malware activity described in the other reporting.
Jun 29, 2026