Loading story…
Group-IB reported that the Smishing Error524 operation has run since the second half of 2025, expanding from Latin America to 72 countries while impersonating more than 267 brands across telecommunications, financial services, consumer rewards, government, and logistics. Investigators linked the campaign to at least 4,389 phishing domains, with Mexico the most heavily targeted country, followed by Chile and Colombia. The attack begins with SMS lures sent from local-looking numbers and shortened links, directing victims to phishing pages designed to harvest national identification numbers, personal details, and full payment card information.
The infrastructure uses a layered anti-analysis design that shows fake Cloudflare Error 524 pages to researchers, scanners, and other non-targeted visitors, while only users matching geofencing, mobile device, and session checks receive the malicious content. Group-IB said the phishing kit is an obfuscated Vue.js single-page application using Base64-encoded content and FormKit, with stolen data exfiltrated in real time over encrypted WebSocket channels and heartbeat telemetry. Operators also hid backend systems behind Cloudflare proxies and used origin hosting tied to Tencent Cloud and Alibaba Cloud, helping mask infrastructure and rotate domains quickly.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Group-IB reported that the Smishing Error524 smishing and phishing operation has been active since the second half of 2025, initially focusing on Latin America. The campaign used SMS lures and phishing infrastructure impersonating major brands to steal personal and payment data.
On June 5, 2026, Group-IB published findings on Smishing Error524, describing a campaign expanded to 72 countries, impersonating more than 267 brands, and using 4,389 phishing domains. The report detailed the operation's anti-analysis design, fake Cloudflare error-page decoys, and encrypted WebSocket-based data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified a large-scale, decentralized phishing campaign known as Smishing Triad, which leverages SMS messages to impersonate services across critical sectors including banking, e-commerce, healthcare, law enforcement, and social media. The operation, managed in Chinese and supported by a network of thousands of malicious actors, has registered nearly 195,000 domains since January 2024, primarily through a Hong Kong-based registrar and using Chinese DNS infrastructure, but with most attack domains hosted on U.S.-based cloud services. The campaign targets victims globally, with a notable focus on U.S. residents, and uses sophisticated social engineering tactics to collect sensitive information such as national identification numbers, home addresses, financial details, and credentials. The Smishing Triad campaign is highly decentralized, involving a range of specialists including data brokers, domain sellers, phishing kit developers, and spammers who deliver lures via mobile messaging apps. The group’s infrastructure and phishing kits are also used by other threat actors, further expanding its reach. The campaign’s scale, complexity, and use of phishing-as-a-service (PhaaS) models make it a significant and evolving threat, with attackers continuously adapting their tactics and expanding the range of impersonated services to maximize the effectiveness of their phishing operations.
Jun 29, 2026
Researchers exposed two closely related smishing operations that impersonated parcel-delivery brands and used phishing kits with **live operator consoles** to steal identity and payment-card data. In one case, investigators tied a J&T Express lure to a short-lived domain, `jtexpress.mwkqbr[.]club`, and found a kit that harvested full identity details and card information before relaying victims into OTP, PIN, app, email, or CVV challenge screens. Static analysis showed AES-128-CBC encryption in browser storage and socket transport, a Socket.IO relay on the `/com/socket.io/` path, multiple client-side verification routes, and Chinese debug strings, while the infrastructure was registered through Dominet (HK) Limited and fronted by Cloudflare before being suspended days later. The findings mirror a broader investigation into **Darcula** and its `Magic Cat` phishing platform, which used smishing messages posing as postal and delivery services and streamed victim data in real time to an operator “admin” room. Researchers said the platform functioned as a mature phishing-as-a-service business with licensing, activation management, template distribution, real-time victim interaction, and possible backdoor capability, and linked it to Telegram communities and large-scale criminal monetization. The combined reporting indicates an industrialized ecosystem in which human operators actively guide victims through bank verification steps, allowing attackers to bypass 3D Secure protections and compromise hundreds of thousands of targets.
Aug 24, 2026
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026