Loading story…
The Lighthouse and Lucid PhaaS platforms have enabled attackers to target more than 300 brands globally using over 17,500 phishing domains. These platforms offer real-time victim monitoring and templates for over 200 services, making takedown efforts challenging. Their infrastructure and targeting overlaps highlight increasing collaboration and innovation in the phishing ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SC Media reported that the Lighthouse and Lucid phishing-as-a-service platforms were associated with thousands of domains, suggesting significant infrastructure scale behind the campaigns. No more specific event date is given in the reference, so the publication date is used.
A report published by SC Media said AI tools were being exploited to create counterfeit CAPTCHA challenges, indicating a new abuse case for AI-enabled phishing or fraud workflows. No earlier event date is provided in the reference, so the publication date is used.
7 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly hosting phishing infrastructure on legitimate cloud and decentralized platforms, including **Cloudflare Workers**, **Cloudflare Pages**, **Vercel**, **GitHub Pages**, **Netlify**, and **IPFS** gateways, to evade detection and benefit from trusted shared-domain reputation and free-tier scalability. Securelist reported that defenders blocked **224,984** unique third-level domains tied to phishing on these services between August 2025 and July 2026, and identified and neutralized more than **390,000** phishing pages. One documented campaign used a compromised website as an initial relay before directing victims to Cloudflare Workers subdomains for staging, where attackers deployed service workers and the **Ultraviolet** proxy library to transparently intercept traffic in an adversary-in-the-middle attack. The operation also used a browser-in-the-browser spoof to imitate Microsoft login prompts and steal **credentials**, **MFA codes**, and **session tokens**, underscoring how legitimate cloud infrastructure is being repurposed to support large-scale credential theft.
Aug 4, 2026
Google has filed a civil lawsuit in the US Southern District of New York against 25 individuals alleged to be behind a large-scale phishing-as-a-service operation known as Lighthouse. The company accuses a Chinese cybercriminal group of selling "phishing for dummies" kits that enable even inexperienced fraudsters to launch widespread SMS and e-commerce scams. These kits provide hundreds of templates for fake websites, domain setup tools, and other resources, allowing attackers to impersonate well-known brands, government agencies such as USPS, and toll collection firms, tricking victims into disclosing sensitive information like passwords and financial details. The Lighthouse network, also referred to as part of the "Smishing Triad," is accused of targeting millions of people in over 120 countries, including a significant number of Americans. Google alleges that the group has generated over a billion dollars through these scams and has abused Google's logos and technology to increase the credibility of their fraudulent sites. The lawsuit represents one of the most high-profile legal actions against transnational smishing operations, highlighting the growing threat posed by organized cybercrime groups leveraging phishing-as-a-service platforms.
Jun 29, 2026
Cybercriminals are increasingly utilizing advanced Phishing-as-a-Service (PhaaS) kits to conduct large-scale, targeted phishing campaigns that impersonate trusted brands and institutions. These kits, which have doubled in number over the past year, enable even less-skilled attackers to deploy sophisticated attacks at scale by incorporating features such as URL obfuscation, MFA bypass, CAPTCHA abuse, and the use of malicious QR codes and attachments. Threat analysts have observed a surge in new PhaaS entrants, including Cephas, Whisper 2FA, and GhostFrame, alongside established kits like Tycoon 2FA and Mamba 2FA. Attackers are also leveraging AI, social engineering, and polymorphic techniques to evade detection, making it increasingly difficult for organizations to defend against these threats with static security controls alone. Technical analysis reveals that phishing infrastructure is evolving to include fake verification pages, such as counterfeit Cloudflare Turnstile challenges, which act as intelligent traffic filtering gates. These pages use browser fingerprinting, geolocation, and proxy detection to selectively deliver malicious payloads to high-confidence victims while evading security researchers and automated defenses. The fake verification pages closely mimic legitimate branding and user experience, including fabricated Ray IDs and links to real policy documents, to build trust and bypass scrutiny. Security experts recommend adopting layered defenses, including phishing-resistant MFA, continuous monitoring, and integrated email security, to counter these increasingly sophisticated phishing operations.
Jun 29, 2026