Smishing Triad brokerage-account phishing surges fivefold in Q2 2025
Trend
Summary
Hide ▲
Show ▼
Brokerage accounts are seeing a sharp rise in smishing-driven credential theft, with attacks climbing fivefold in Q2 2025 versus the same period a year earlier. The shift increases the risk of banking credential and authentication code theft for financial-account holders. The targeting pattern is linked to phishing kits associated with the Smishing Triad, making brokerage users a more prominent fraud target.
Related Happenings
QR code phishing surged across email threats in Q1 2026
Trend
H score73
First: 05.05.2026 09:35
Last: 05.05.2026 09:35
Sources 1
About this happening:
Q1 2026 email-threat telemetry shows QR code phishing and CAPTCHA-gated phishing rising quickly, increasing the risk of credential theft across organizations....
QR code phishing surged across email threats in Q1 2026
TrendAbout this happening: Q1 2026 email-threat telemetry shows QR code phishing and CAPTCHA-gated phishing rising quickly, increasing the risk of credential theft across organizations....
Tycoon 2FA-Storm-1747 ecosystem shift changes threat-actor operations
Threat Actor Meta
H score82
First: 05.03.2026 08:51
Last: 05.03.2026 08:51
Sources 1
About this happening:
Tycoon2FA has shifted from a subscription-based PhaaS and AitM credential harvester into a more resilient campaign that now uses device-code phishing against Mic...
Tycoon 2FA-Storm-1747 ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: Tycoon2FA has shifted from a subscription-based PhaaS and AitM credential harvester into a more resilient campaign that now uses device-code phishing against Mic...
Latest development: 17.05.2026 17:43
eSentire says Tycoon2FA now uses device-code phishing to target Microsoft 365 accounts, with invoice-themed lure emails carrying Trustifi click-tracking URLs that redirect through Trustifi, Cloudflare Workers, obfuscated JavaScript layers, and a fake Microsoft CAPTCHA page before sending victims to microsoft.com/devicelogin. The kit also adds anti-analysis defenses, including detection of Selenium, Puppeteer, Playwright, and Burp Suite, plus blocks for security vendors, VPNs, sandboxes, AI crawlers, and cloud providers.
Record crypto-fraud losses rise with AI-driven impersonation
Trend
H score43
First: 14.01.2026 12:00
Last: 14.01.2026 12:00
Sources 1
About this happening:
Cryptocurrency fraud is surging as scammers use AI chatbots and brand impersonation to widen victim reach and raise payout sizes. A Malwarebytes Labs analysis foun...
Record crypto-fraud losses rise with AI-driven impersonation
TrendAbout this happening: Cryptocurrency fraud is surging as scammers use AI chatbots and brand impersonation to widen victim reach and raise payout sizes. A Malwarebytes Labs analysis foun...
China-based groups selling phishing-as-a-service kits for mobile-points smishing
Threat Actor Meta
H score28
First: 05.12.2025 01:02
Last: 05.12.2025 01:02
Sources 1
About this happening:
Multiple China-based cybercriminal groups are selling phishing-as-a-service platforms that reuse the same scam infrastructure across mobile points, tax-refund, and...
China-based groups selling phishing-as-a-service kits for mobile-points smishing
Threat Actor MetaAbout this happening: Multiple China-based cybercriminal groups are selling phishing-as-a-service platforms that reuse the same scam infrastructure across mobile points, tax-refund, and...
Smishing Triad evolves into a multi-role phishing-as-a-service ecosystem
Threat Actor Meta
H score77
First: 24.10.2025 21:35
Last: 24.10.2025 21:35
Sources 1
How related:
The adversarial collective is said to have evolved from a dedicated phishing kit purveyor into a "highly active community" that brings together disparate threat actors, each of whom plays a crucial role in the phishing-as-a-service (PhaaS) ecosystem.
About this happening:
Smishing Triad has evolved from a phishing-kit purveyor into a multi-role phishing-as-a-service (PhaaS) ecosystem, making its smishing operation more scalable and harder t...
Smishing Triad evolves into a multi-role phishing-as-a-service ecosystem
Threat Actor MetaHow related: The adversarial collective is said to have evolved from a dedicated phishing kit purveyor into a "highly active community" that brings together disparate threat actors, each of whom plays a crucial role in the phishing-as-a-service (PhaaS) ecosystem.
About this happening: Smishing Triad has evolved from a phishing-kit purveyor into a multi-role phishing-as-a-service (PhaaS) ecosystem, making its smishing operation more scalable and harder t...
Timeline
-
24.10.2025 21:35 2 articles · 8mo ago
Smishing Triad phishing kits target brokerage accounts in a fivefold Q2 2025 surge
Initial DisclosureFortra reported that phishing kits associated with the Smishing Triad are increasingly targeting brokerage accounts to steal banking credentials and authentication codes, and that attacks against those accounts rose fivefold in the second quarter of 2025 compared with the same period in 2024.
Show sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35