Loading story…
A large-scale phishing campaign is using fake shipment-tracking messages to impersonate courier and postal brands across the Middle East and Africa, capitalizing on heavy consumer reliance on e-commerce and delivery services. Group-IB reported that victims are contacted through SMS sent from anonymous local-looking numbers or via Sender ID spoofing, then redirected to mobile-optimized phishing pages designed to harvest personal information, payment card data, banking credentials, and one-time passwords. Researchers said postal and delivery services were the most abused lure in 2025, followed by financial services, telecommunications, mobility services, and e-commerce platforms.
Technical analysis of the phishing pages found embedded scripts, persistent WebSocket connections, real-time keylogging, direct credential exfiltration, and UUID-based session tracking, indicating a mature and highly interactive fraud operation. Group-IB also identified infrastructure overlaps and other characteristics linked to the Darcula phishing-as-a-service ecosystem, although it did not definitively attribute the activity to a single actor. The campaign has broadened beyond parcel-delivery themes to include fake online shop notices, transportation apps, bill payments, fines, subscriptions, and telecom-service messages.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Technical analysis of the campaign found mobile-optimized phishing pages using embedded scripts, persistent WebSocket connections, real-time keylogging, direct credential exfiltration, and UUID-based session tracking. Group-IB also identified infrastructure overlaps and characteristics associated with the Darcula phishing-as-a-service ecosystem, though it did not definitively attribute the activity to a single actor.
During 2025, the phishing operation broadened from parcel-delivery scams to impersonate financial services, telecommunications providers, mobility services, e-commerce platforms, online shops, transportation apps, bill payments, fines, and subscription services. Postal and delivery brands remained the most abused theme, followed by other consumer-facing sectors.
Group-IB observed substantial growth in a large-scale phishing campaign during 2025 that used fake shipment-tracking messages to impersonate courier and postal brands in the Middle East and Africa. The activity primarily targeted mobile users and expanded alongside heavy reliance on e-commerce and delivery services.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers exposed two closely related smishing operations that impersonated parcel-delivery brands and used phishing kits with **live operator consoles** to steal identity and payment-card data. In one case, investigators tied a J&T Express lure to a short-lived domain, `jtexpress.mwkqbr[.]club`, and found a kit that harvested full identity details and card information before relaying victims into OTP, PIN, app, email, or CVV challenge screens. Static analysis showed AES-128-CBC encryption in browser storage and socket transport, a Socket.IO relay on the `/com/socket.io/` path, multiple client-side verification routes, and Chinese debug strings, while the infrastructure was registered through Dominet (HK) Limited and fronted by Cloudflare before being suspended days later. The findings mirror a broader investigation into **Darcula** and its `Magic Cat` phishing platform, which used smishing messages posing as postal and delivery services and streamed victim data in real time to an operator “admin” room. Researchers said the platform functioned as a mature phishing-as-a-service business with licensing, activation management, template distribution, real-time victim interaction, and possible backdoor capability, and linked it to Telegram communities and large-scale criminal monetization. The combined reporting indicates an industrialized ecosystem in which human operators actively guide victims through bank verification steps, allowing attackers to bypass 3D Secure protections and compromise hundreds of thousands of targets.
Aug 24, 2026
Researchers have identified a large-scale, decentralized phishing campaign known as Smishing Triad, which leverages SMS messages to impersonate services across critical sectors including banking, e-commerce, healthcare, law enforcement, and social media. The operation, managed in Chinese and supported by a network of thousands of malicious actors, has registered nearly 195,000 domains since January 2024, primarily through a Hong Kong-based registrar and using Chinese DNS infrastructure, but with most attack domains hosted on U.S.-based cloud services. The campaign targets victims globally, with a notable focus on U.S. residents, and uses sophisticated social engineering tactics to collect sensitive information such as national identification numbers, home addresses, financial details, and credentials. The Smishing Triad campaign is highly decentralized, involving a range of specialists including data brokers, domain sellers, phishing kit developers, and spammers who deliver lures via mobile messaging apps. The group’s infrastructure and phishing kits are also used by other threat actors, further expanding its reach. The campaign’s scale, complexity, and use of phishing-as-a-service (PhaaS) models make it a significant and evolving threat, with attackers continuously adapting their tactics and expanding the range of impersonated services to maximize the effectiveness of their phishing operations.
Jun 29, 2026
A large-scale smishing operation sent fraudulent mobile text messages that impersonated toll road operators, package delivery firms, and government agencies, luring victims to mobile-optimized phishing sites built to steal credentials, payment card data, and other sensitive information. Researchers linked the activity to industrialized phishing infrastructure using spoofed brands, dynamically generated subdomains, low-cost `.top` and `.cc` domains, Let's Encrypt certificates, geo-fencing, and cloud-hosted servers, with campaigns targeting services in the UAE, Singapore, and other regions including transportation, logistics, and public-sector brands such as Emirates Post, Salik, Parkin, Dubai Police, Aramex, and Singapore's Land Transport Authority. Google said it filed a lawsuit against a China-linked scam network known as **Outsider Enterprise**, alleging the group abused **Gemini** to help create phishing content and fake websites impersonating brands including Google, YouTube, and **New York E-ZPass**. According to the filing, the operation marketed phishing-as-a-service through Telegram with nearly 300 scam templates for customers, while Google coordinated with **AT&T**, **Verizon**, and **T-Mobile** to block malicious texts; the company also said Google Messages scam detection now blocks about **10 billion** scam texts each month.
Jul 7, 2026