PhishingPublished 27 Jun 2026

Chinese Framework Powers 200,000 Scam Sites

Source SecurityWeek

Description

Threat actors are selling investment scam templates created using the legitimate DCloud Uni-App toolkit. The post Chinese Framework Powers 200,000 Scam Sites appeared first on SecurityWeek .

Impact

The impact is financial and reputational harm caused by widespread investment scams facilitated by websites built with Uni-App templates. Victims have lost money to fake cryptocurrency platforms, gambling sites, and phishing operations. The scam ecosystem is large and growing, with coordinated activity suggesting centralized control of many domains. The framework’s legitimate use is overshadowed by its exploitation in fraudulent schemes, leading to significant monetary losses and erosion of trust in online investment platforms.

Defensive guidance

Organizations and users should be aware that the threat arises from the malicious use of legitimate development tools to create scam sites. Mitigation involves user education to recognize investment scams, blocking known scam domains where possible, and monitoring for fraudulent activity. Vendors managing domain registrations and hosting providers should continue efforts to disrupt these scam infrastructures. Check vendor advisories and threat intelligence sources for updates on takedown efforts and emerging scam patterns.

Summary

The threat involves the abuse of the legitimate DCloud Uni-App cross-platform development framework by cybercriminals to build and distribute investment scam website templates. These templates power a large ecosystem of fraudulent sites, including fake crypto exchanges, gambling impersonators, and phishing platforms. Infoblox research identified over 236,000 second-level domains linked to these scams, which have been active since mid-2022 with a notable increase after late 2024. The scam infrastructure is operated by multiple unrelated threat actors, possibly dozens or hundreds, some of which have caused millions in losses. The framework itself is not compromised, and no vulnerability in Uni-App has been reported; rather, the threat is the malicious use of a legitimate development tool.

References

securityweek.com/chinese-framework-powers-200000-scam-sites/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Jun 2026, 12:21 UTC

References

Community reviews