Wang Duo Yu rebrands Smishing Triad into Lighthouse's subscription phishing-kit ecosystem
Threat Actor Meta
Summary
Hide ▲
Show ▼
Wang Duo Yu rebranded Smishing Triad as Lighthouse, converting the operation into a commercial phishing-as-a-service business that lowered the barrier for mass smishing. The shift matters because the service sold subscription access to templates, infrastructure, and support, turning one crew's tooling into a broader criminal ecosystem. That ecosystem has been tied to USPS and E-ZPass impersonation scams that continued through 2025 across the United States.
Related Happenings
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor Meta
First: 14.04.2026 15:00
Last: 14.04.2026 15:00
Sources 1
About this happening:
**Triad Nexus** expanded its fraud ecosystem after **US Treasury sanctions in 2025**, increasing operational scale and shifting into **emerging markets**. The network’s use of **U...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor MetaAbout this happening: **Triad Nexus** expanded its fraud ecosystem after **US Treasury sanctions in 2025**, increasing operational scale and shifting into **emerging markets**. The network’s use of **U...
Triad Nexus investment scam and brand impersonation campaign targeting emerging markets
Campaign
First: 14.04.2026 15:00
Last: 14.04.2026 15:00
Sources 1
About this happening:
The **Triad Nexus** campaign is continuing to run **large-scale investment scams** and **brand impersonation**, expanding into **emerging markets** and driving higher fraud losses...
Triad Nexus investment scam and brand impersonation campaign targeting emerging markets
CampaignAbout this happening: The **Triad Nexus** campaign is continuing to run **large-scale investment scams** and **brand impersonation**, expanding into **emerging markets** and driving higher fraud losses...
Smishing Triad expanding SMS phishing campaign
Campaign
First: 25.11.2025 18:00
Last: 25.11.2025 18:00
Sources 1
About this happening:
The **Smishing Triad** is expanding a **SMS phishing and fraud campaign** that uses **impersonation domains** to steal data from **individuals and organizations**. The operation n...
Smishing Triad expanding SMS phishing campaign
CampaignAbout this happening: The **Smishing Triad** is expanding a **SMS phishing and fraud campaign** that uses **impersonation domains** to steal data from **individuals and organizations**. The operation n...
Smishing Triad Lighthouse SMS phishing campaign targeting mobile users
Campaign
First: 13.11.2025 16:47
Last: 13.11.2025 16:47
Sources 1
About this happening:
The **Smishing Triad** is running a **large-scale SMS phishing campaign** through **Lighthouse**, using trusted-brand impersonation to reach **millions of text messages** and more...
Smishing Triad Lighthouse SMS phishing campaign targeting mobile users
CampaignAbout this happening: The **Smishing Triad** is running a **large-scale SMS phishing campaign** through **Lighthouse**, using trusted-brand impersonation to reach **millions of text messages** and more...
Latest development: 14.11.2025 11:45
Google said Lighthouse, the phishing-as-a-service kit linked to the Smishing Triad, was used to launch 32,094 distinct US Postal Service (USPS) phishing websites from July 2023 through October 2024, and that at least 116 templates featured Google logos or branding while the operation targeted over one million people in over 121 countries.
Wang Duo Yu markets Lighthouse as a commercial phishing kit ecosystem
Threat Actor Meta
First: 12.11.2025 22:59
Last: 12.11.2025 22:59
Sources 1
About this happening:
The **Lighthouse** platform is being sold as a paid **phishing-as-a-service** ecosystem, widening access to smishing infrastructure and increasing the scale of payment-card theft....
Wang Duo Yu markets Lighthouse as a commercial phishing kit ecosystem
Threat Actor MetaAbout this happening: The **Lighthouse** platform is being sold as a paid **phishing-as-a-service** ecosystem, widening access to smishing infrastructure and increasing the scale of payment-card theft....
Timeline
-
12.11.2025 22:59 2 articles · 6mo ago
Google disclosure of Lighthouse and the Smishing Triad rebrand
Initial DisclosureGoogle files a lawsuit to dismantle Lighthouse, a phishing-as-a-service platform used for USPS and E-ZPass smishing, while the broader ecosystem is described as a commercial phishing-kit operation tied to Wang Duo Yu and a March 2025 rebrand from Smishing Triad to Lighthouse. Cisco Talos linked the kits to Telegram-based sales and support, and Netcraft said the service sold subscriptions from $88 per week to $1,588 per year.
Show sources
- Google sues to dismantle Chinese phishing platform behind US toll scams — www.bleepingcomputer.com — 12.11.2025 22:59
- Google sues to dismantle Chinese phishing platform behind US toll scams — www.bleepingcomputer.com — 12.11.2025 22:59