Unit 42 researchers uncovered a massive Smishing Triad operation that registered over 194,000 malicious domains since January 2024, impersonating banks, government agencies, and e-commerce sites globally. The campaign operates as a phishing-as-a-service ecosystem with specialized threat actors handling different attack stages, churning through domains at breakneck speed: 71.3% stay active less than a week to dodge detection. Despite Chinese infrastructure (Hong Kong registrars, Chinese nameservers), they’re freeloading on U.S. cloud services to host their operation. Two days later, Google sued 25 unnamed defendants it links to Lighthouse, a Smishing Triad phishing kit that Google says has hit over a million victims in 120 countries by enrolling stolen cards in mobile wallets.
