Wang Duo Yu rebrands Smishing Triad into Lighthouse's subscription phishing-kit ecosystem
Threat Actor Meta
Summary
Hide ▲
Show ▼
Wang Duo Yu rebranded Smishing Triad as Lighthouse, converting the operation into a commercial phishing-as-a-service business that lowered the barrier for mass smishing. The shift matters because the service sold subscription access to templates, infrastructure, and support, turning one crew's tooling into a broader criminal ecosystem. That ecosystem has been tied to USPS and E-ZPass impersonation scams that continued through 2025 across the United States.
Related Happenings
Paid brand-impersonation phishing kits Lucid and Lighthouse scale fake-domain operations
Threat Actor Meta
H score37
First: 01.07.2026 10:20
Last: 01.07.2026 10:20
Sources 1
About this happening:
Brand-impersonation phishing has become a **paid service**, with kits like **Lucid** and **Lighthouse** scaling fake-domain operations across **316 brands** in **74 countries**, i...
Paid brand-impersonation phishing kits Lucid and Lighthouse scale fake-domain operations
Threat Actor MetaAbout this happening: Brand-impersonation phishing has become a **paid service**, with kits like **Lucid** and **Lighthouse** scaling fake-domain operations across **316 brands** in **74 countries**, i...
Outsider Enterprise-Outsider-Chinese cybercrime alliance reshapes ransomware ecosystem operations
Threat Actor Meta
H score69
First: 12.06.2026 21:59
Last: 12.06.2026 21:59
Sources 1
About this happening:
The **Outsider Enterprise** is a **Chinese phishing-as-a-service** operation that used **Telegram**, **AI**, and distributed phishing kits to run large-scale brand-impersonation c...
Outsider Enterprise-Outsider-Chinese cybercrime alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: The **Outsider Enterprise** is a **Chinese phishing-as-a-service** operation that used **Telegram**, **AI**, and distributed phishing kits to run large-scale brand-impersonation c...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor Meta
H score43
First: 14.04.2026 15:00
Last: 14.04.2026 15:00
Sources 1
About this happening:
**Triad Nexus** expanded its fraud ecosystem after **US Treasury sanctions in 2025**, increasing operational scale and shifting into **emerging markets**. The network’s use of **U...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor MetaAbout this happening: **Triad Nexus** expanded its fraud ecosystem after **US Treasury sanctions in 2025**, increasing operational scale and shifting into **emerging markets**. The network’s use of **U...
Triad Nexus investment scam and brand impersonation campaign targeting emerging markets
Campaign
H score33
First: 14.04.2026 15:00
Last: 14.04.2026 15:00
Sources 1
About this happening:
The **Triad Nexus** campaign is continuing to run **large-scale investment scams** and **brand impersonation**, expanding into **emerging markets** and driving higher fraud losses...
Triad Nexus investment scam and brand impersonation campaign targeting emerging markets
CampaignAbout this happening: The **Triad Nexus** campaign is continuing to run **large-scale investment scams** and **brand impersonation**, expanding into **emerging markets** and driving higher fraud losses...
Smishing Triad expanding SMS phishing campaign
Campaign
H score30
First: 25.11.2025 18:00
Last: 25.11.2025 18:00
Sources 1
About this happening:
The **Smishing Triad** is expanding a **SMS phishing and fraud campaign** that uses **impersonation domains** to steal data from **individuals and organizations**. The operation n...
Smishing Triad expanding SMS phishing campaign
CampaignAbout this happening: The **Smishing Triad** is expanding a **SMS phishing and fraud campaign** that uses **impersonation domains** to steal data from **individuals and organizations**. The operation n...
Timeline
-
12.11.2025 22:59 2 articles · 7mo ago
Google disclosure of Lighthouse and the Smishing Triad rebrand
Initial DisclosureGoogle files a lawsuit to dismantle Lighthouse, a phishing-as-a-service platform used for USPS and E-ZPass smishing, while the broader ecosystem is described as a commercial phishing-kit operation tied to Wang Duo Yu and a March 2025 rebrand from Smishing Triad to Lighthouse. Cisco Talos linked the kits to Telegram-based sales and support, and Netcraft said the service sold subscriptions from $88 per week to $1,588 per year.
Show sources
- Google sues to dismantle Chinese phishing platform behind US toll scams — www.bleepingcomputer.com — 12.11.2025 22:59
- Google sues to dismantle Chinese phishing platform behind US toll scams — www.bleepingcomputer.com — 12.11.2025 22:59