Smishing Triad's Global Phishing Campaign Targets 194,000 Domains
Summary
Hide ▲
Show ▼
A China-linked threat actor group, the Smishing Triad, has been linked to over 194,000 malicious domains used in a global smishing campaign since January 1, 2024. The campaign targets various services worldwide, including the U.S. Postal Service and toll services. The group has evolved into a highly active community within the phishing-as-a-service (PhaaS) ecosystem, generating over $1 billion in the last three years. The domains are registered through a Hong Kong-based registrar and use Chinese nameservers, but the infrastructure is hosted on U.S. cloud services. The campaign employs rapid domain churn to evade detection and uses a variety of tactics to trick users into providing sensitive information.
Timeline
-
24.10.2025 21:35 1 articles · 23h ago
Smishing Triad's Global Phishing Campaign Linked to 194,000 Domains
Since January 1, 2024, the Smishing Triad has been linked to over 194,000 malicious domains used in a global smishing campaign. The campaign targets various services worldwide, including the U.S. Postal Service and toll services. The group has evolved into a highly active community within the phishing-as-a-service (PhaaS) ecosystem, generating over $1 billion in the last three years. The domains are registered through a Hong Kong-based registrar and use Chinese nameservers, but the infrastructure is hosted on U.S. cloud services. The campaign employs rapid domain churn to evade detection and uses a variety of tactics to trick users into providing sensitive information.
Show sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
Information Snippets
-
The Smishing Triad has registered over 194,000 malicious domains since January 1, 2024.
First reported: 24.10.2025 21:351 source, 1 articleShow sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
-
The campaign targets a broad range of services, including the U.S. Postal Service and toll services.
First reported: 24.10.2025 21:351 source, 1 articleShow sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
-
The group has generated over $1 billion in the last three years through these campaigns.
First reported: 24.10.2025 21:351 source, 1 articleShow sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
-
The domains are registered through a Hong Kong-based registrar and use Chinese nameservers.
First reported: 24.10.2025 21:351 source, 1 articleShow sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
-
The attack infrastructure is primarily hosted on U.S. cloud services.
First reported: 24.10.2025 21:351 source, 1 articleShow sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
-
The Smishing Triad has evolved into a highly active community within the PhaaS ecosystem.
First reported: 24.10.2025 21:351 source, 1 articleShow sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
-
The campaign employs rapid domain churn to evade detection.
First reported: 24.10.2025 21:351 source, 1 articleShow sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35
-
The group uses a variety of tactics to trick users into providing sensitive information.
First reported: 24.10.2025 21:351 source, 1 articleShow sources
- Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation — thehackernews.com — 24.10.2025 21:35