Loading story…
Infoblox reported that criminals have abused DCloud’s legitimate Uni-App cross-platform framework to build a sprawling scam ecosystem spanning at least 236,493 second-level domains and more than 200,000 scam websites. The infrastructure has been used for fake cryptocurrency exchanges, investment-fraud portals, gambling and prediction-market impersonation, WhatsApp phishing pages, credential-harvesting sites, and crypto wallet drainers. Investigators said the domains have been launched since mid-2022 across many hosting providers, with technical and registration patterns indicating a coordinated network operated by multiple actors rather than a single group.
The activity drew wider attention after the RainbowEx scandal in San Pedro, Argentina, where investigators found the platform had been built with Uni-App, and researchers said domain creation accelerated sharply after late 2024, peaking at roughly 15,000 newly observed scam sites per month. Infoblox also linked the framework to other real-world schemes, including Lightning Shared Scooter Co. in the United States and Yuechi Sharing Technology Ltd. operating in Australia, New Zealand, and the United States, while observed templates impersonated brands and services such as WhatsApp, BNB Chain verification flows, the Hong Kong Stock Exchange, and other financial platforms. DCloud was identified as a legitimate Chinese software company and was not accused of participating in the fraud.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
In 2024, the RainbowEx scandal in San Pedro, Argentina, helped expose the broader scam network after investigators found RainbowEx had been built with Uni-App. The incident became a key real-world example linking the framework to investment fraud.
Infoblox linked the Uni-App-based ecosystem to other named investment scams, including Lightning Shared Scooter Co. in the United States and Yuechi Sharing Technology Ltd. operating in Australia, New Zealand, and the United States. The reporting also described phishing templates impersonating brands and services such as WhatsApp, BNB Chain verification flows, and the Hong Kong Stock Exchange.
Infoblox reported that more than 200,000 scam websites, spanning at least 236,493 distinct second-level domains, were using templates built with DCloud's Uni-App framework. The company said the infrastructure supported fake crypto exchanges, gambling and prediction-market impersonation, WhatsApp phishing, credential harvesting, multilingual pig-butchering schemes, and crypto wallet drainers.
The reported scam activity accelerated after October 2024, with newly observed DCloud-based scam sites peaking at roughly 15,000 per month. SecurityWeek similarly noted sharp domain growth after the RainbowEx scandal gained major media attention in late 2024.
Infoblox reported that scam domains built with DCloud's legitimate Uni-App framework have been launched since mid-2022 across many hosting providers. The infrastructure was later tied to a broad range of fraud, including fake investment platforms, phishing, and wallet-drainer sites.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized **Keitaro**, a self-hosted ad-tracking platform, across an ecosystem of roughly **15,500 malicious domains**, including about **9,000** registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as **FaiKast** using deepfake news-style cryptocurrency ads, **WickedWally** targeting U.S. seniors with fake benefits and debt-relief offers, and **FishSteaks** running giveaway scams impersonating consumer brands. Netskope separately documented a parallel TDS-for-hire operation built around more than **12,700** fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom **Elixir/Phoenix** routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included **Legion Loader**, a reseller TDS gate linked to `yfdpco` domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Aug 6, 2026
Researchers uncovered two large-scale malicious infrastructures that used Cloudflare-fronted domains and wildcard subdomains to hide centralized backend systems. In one campaign, investigators traced an **adversary-in-the-middle (AiTM)** phishing operation from four suspicious domains to at least seven domains and more than **200 subdomains** impersonating enterprise **VPN** and **SSO** portals, including Palo Alto GlobalProtect, Fortinet FortiGate, Cisco AnyConnect, Citrix, and Microsoft OWA. The phishing flow presented fake Cloudflare challenge pages before credential prompts, and the infrastructure was linked to a single origin server at `178.16.53.131` in Germany. Researchers said the platform could relay live authentication sessions and steal both credentials and session tokens, allowing attackers to bypass traditional MFA protections. A separate investigation tied a single ClearFake indicator to a broader malware delivery network spanning **24 `.in.net` domains**, more than **100 subdomains**, two Cloudflare account clusters, and a shared **WebDAV** origin server. Analysts found wildcard DNS and TLS certificates across the domains, identical `ETag` values indicating common hosting, and an exposed payload inventory accessible through unauthenticated WebDAV requests. The campaign used compromised websites to redirect victims to fake verification pages and then delivered malicious DLLs and two newly identified obfuscated Go binaries disguised as Logitech and Intel components. Breakglass reported that the recovered payloads had **zero detections** in VirusTotal and MalwareBazaar at the time of discovery, while multiple OPSEC mistakes—including leaked headers, an exposed staging directory, and a recurring "werification" typo—helped map the operation.
Jun 29, 2026
A senior **U.S. Secret Service** official warned that weaknesses in the internet’s domain registration and governance model are being actively exploited to scale phishing and fraud, citing the ease with which attackers can register deceptive, brand-imitating domains and then force defenders into reactive, court-driven takedowns. The official argued that insufficient identity validation in domain registration and abuse concentration in certain networks (e.g., via **ASNs**) represent systemic gaps that enable business email compromise and link-based phishing campaigns across SMS and email. Threat intelligence reporting on Canada-linked fraud activity illustrates how these domain-registration weaknesses translate into operational campaigns: attackers are using lookalike domains, SMS lures, and paid ads to drive victims to convincing fake portals impersonating **PayBC, ServiceOntario, Canada Post, CRA, and Air Canada** to steal credentials and payment data. CloudSEK attributed much of the activity to the **“PayTool” phishing ecosystem**, describing reusable phishing kits and shared infrastructure that can be rapidly rebranded and expanded from provincial payment portals into broader “Government of Canada” themed entry points. Separate coverage of Anguilla’s `.ai` domain boom is primarily economic/industry-focused and does not provide substantive security reporting tied to the phishing and domain-abuse problem described above.
Jun 29, 2026