Wang Duo Yu rebrands Smishing Triad into Lighthouse's subscription phishing-kit ecosystem
Threat Actor Meta
Summary
Hide ▲
Show ▼
Wang Duo Yu rebranded Smishing Triad as Lighthouse, converting the operation into a commercial phishing-as-a-service business that lowered the barrier for mass smishing. The shift matters because the service sold subscription access to templates, infrastructure, and support, turning one crew's tooling into a broader criminal ecosystem. That ecosystem has been tied to USPS and E-ZPass impersonation scams that continued through 2025 across the United States.
Related Happenings
Paid brand-impersonation phishing kits Lucid and Lighthouse scale fake-domain operations
Threat Actor Meta
H score37
First: 01.07.2026 10:20
Last: 01.07.2026 10:20
Sources 1
About this happening:
Brand-impersonation phishing has become a paid service, with kits like Lucid and Lighthouse scaling fake-domain operations across 316 brands in 74 countries, i...
Paid brand-impersonation phishing kits Lucid and Lighthouse scale fake-domain operations
Threat Actor MetaAbout this happening: Brand-impersonation phishing has become a paid service, with kits like Lucid and Lighthouse scaling fake-domain operations across 316 brands in 74 countries, i...
Outsider Enterprise-Outsider-Chinese cybercrime alliance reshapes ransomware ecosystem operations
Threat Actor Meta
H score69
First: 12.06.2026 21:59
Last: 12.06.2026 21:59
Sources 1
About this happening:
The Outsider Enterprise is a Chinese phishing-as-a-service operation that used Telegram, AI, and distributed phishing kits to run large-scale brand-impersonation c...
Outsider Enterprise-Outsider-Chinese cybercrime alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: The Outsider Enterprise is a Chinese phishing-as-a-service operation that used Telegram, AI, and distributed phishing kits to run large-scale brand-impersonation c...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor Meta
H score43
First: 14.04.2026 15:00
Last: 14.04.2026 15:00
Sources 1
About this happening:
Triad Nexus expanded its fraud ecosystem after US Treasury sanctions in 2025, increasing operational scale and shifting into emerging markets. The network’s use of U...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor MetaAbout this happening: Triad Nexus expanded its fraud ecosystem after US Treasury sanctions in 2025, increasing operational scale and shifting into emerging markets. The network’s use of U...
Triad Nexus investment scam and brand impersonation campaign targeting emerging markets
Campaign
H score33
First: 14.04.2026 15:00
Last: 14.04.2026 15:00
Sources 1
About this happening:
The Triad Nexus campaign is continuing to run large-scale investment scams and brand impersonation, expanding into emerging markets and driving higher fraud losses...
Triad Nexus investment scam and brand impersonation campaign targeting emerging markets
CampaignAbout this happening: The Triad Nexus campaign is continuing to run large-scale investment scams and brand impersonation, expanding into emerging markets and driving higher fraud losses...
Smishing Triad expanding SMS phishing campaign
Campaign
H score30
First: 25.11.2025 18:00
Last: 25.11.2025 18:00
Sources 1
About this happening:
The Smishing Triad is expanding a SMS phishing and fraud campaign that uses impersonation domains to steal data from individuals and organizations. The operation n...
Smishing Triad expanding SMS phishing campaign
CampaignAbout this happening: The Smishing Triad is expanding a SMS phishing and fraud campaign that uses impersonation domains to steal data from individuals and organizations. The operation n...
Timeline
-
12.11.2025 22:59 2 articles · 8mo ago
Google disclosure of Lighthouse and the Smishing Triad rebrand
Initial DisclosureGoogle files a lawsuit to dismantle Lighthouse, a phishing-as-a-service platform used for USPS and E-ZPass smishing, while the broader ecosystem is described as a commercial phishing-kit operation tied to Wang Duo Yu and a March 2025 rebrand from Smishing Triad to Lighthouse. Cisco Talos linked the kits to Telegram-based sales and support, and Netcraft said the service sold subscriptions from $88 per week to $1,588 per year.
Show sources
- Google sues to dismantle Chinese phishing platform behind US toll scams — www.bleepingcomputer.com — 12.11.2025 22:59
- Google sues to dismantle Chinese phishing platform behind US toll scams — www.bleepingcomputer.com — 12.11.2025 22:59