Loading story…
Researchers exposed two closely related smishing operations that impersonated parcel-delivery brands and used phishing kits with live operator consoles to steal identity and payment-card data. In one case, investigators tied a J&T Express lure to a short-lived domain, jtexpress.mwkqbr[.]club, and found a kit that harvested full identity details and card information before relaying victims into OTP, PIN, app, email, or CVV challenge screens. Static analysis showed AES-128-CBC encryption in browser storage and socket transport, a Socket.IO relay on the /com/socket.io/ path, multiple client-side verification routes, and Chinese debug strings, while the infrastructure was registered through Dominet (HK) Limited and fronted by Cloudflare before being suspended days later.
The findings mirror a broader investigation into Darcula and its Magic Cat phishing platform, which used smishing messages posing as postal and delivery services and streamed victim data in real time to an operator “admin” room. Researchers said the platform functioned as a mature phishing-as-a-service business with licensing, activation management, template distribution, real-time victim interaction, and possible backdoor capability, and linked it to Telegram communities and large-scale criminal monetization. The combined reporting indicates an industrialized ecosystem in which human operators actively guide victims through bank verification steps, allowing attackers to bypass 3D Secure protections and compromise hundreds of thousands of targets.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
The phishing domain mwkqbr.club was placed on clientHold and suspended four days after registration. This disrupted the J&T Express impersonation campaign hosted on the domain.
Cloudflare delegation for mwkqbr.club landed after the domain registration, placing the phishing infrastructure behind Cloudflare. This marked the domain becoming operationally staged for the campaign.
The domain mwkqbr.club, used for a J&T Express-themed smishing campaign, was registered through Dominet (HK) Limited. The phishing URL later used the path jtexpress.mwkqbr[.]club/com.
After investigating the Darcula phishing-as-a-service operation and the Magic Cat phishing kit, researchers compiled a report and shared it with several law enforcement agencies. The article explicitly states this reporting occurred in January 2024.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcemnemonic.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported that the **Smishing Error524** operation has run since the second half of 2025, expanding from Latin America to **72 countries** while impersonating more than **267 brands** across telecommunications, financial services, consumer rewards, government, and logistics. Investigators linked the campaign to at least **4,389 phishing domains**, with **Mexico** the most heavily targeted country, followed by **Chile** and **Colombia**. The attack begins with SMS lures sent from local-looking numbers and shortened links, directing victims to phishing pages designed to harvest national identification numbers, personal details, and full payment card information. The infrastructure uses a layered anti-analysis design that shows fake **Cloudflare Error 524** pages to researchers, scanners, and other non-targeted visitors, while only users matching geofencing, mobile device, and session checks receive the malicious content. Group-IB said the phishing kit is an obfuscated **Vue.js** single-page application using Base64-encoded content and FormKit, with stolen data exfiltrated in real time over encrypted WebSocket channels and heartbeat telemetry. Operators also hid backend systems behind **Cloudflare** proxies and used origin hosting tied to **Tencent Cloud** and **Alibaba Cloud**, helping mask infrastructure and rotate domains quickly.
Jun 29, 2026
A large-scale phishing campaign is using fake shipment-tracking messages to impersonate courier and postal brands across the Middle East and Africa, capitalizing on heavy consumer reliance on e-commerce and delivery services. Group-IB reported that victims are contacted through SMS sent from anonymous local-looking numbers or via Sender ID spoofing, then redirected to mobile-optimized phishing pages designed to harvest personal information, payment card data, banking credentials, and one-time passwords. Researchers said postal and delivery services were the most abused lure in 2025, followed by financial services, telecommunications, mobility services, and e-commerce platforms. Technical analysis of the phishing pages found embedded scripts, persistent WebSocket connections, real-time keylogging, direct credential exfiltration, and UUID-based session tracking, indicating a mature and highly interactive fraud operation. Group-IB also identified infrastructure overlaps and other characteristics linked to the **Darcula** phishing-as-a-service ecosystem, although it did not definitively attribute the activity to a single actor. The campaign has broadened beyond parcel-delivery themes to include fake online shop notices, transportation apps, bill payments, fines, subscriptions, and telecom-service messages.
Jun 29, 2026
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026