Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages

A sophisticated smishing and phishing operation active since the second half of 2025 has impersonated over 267 brands across 72 countries, with particular concentration in Latin America. The campaign generated 4,389 phishing domain instances, with Mexico accounting for 1,851 cases. Telecommunications is the most targeted sector with 1,754 instances, followed by financial services and consumer rewards programs. The operation employs fake Cloudflare error pages as decoys, revealing malicious content only to victims matching specific geofencing and mobile device criteria. Data exfiltration occurs through encrypted WebSocket channels using binary encoded payloads. Approximately 30% of infrastructure is hosted on Tencent Cloud and Alibaba US servers, fronted by Cloudflare to mask hosting IPs. The attack chain progresses from SMS lures through progressive credential harvesting, ultimately capturing complete credit card details including CVV codes.

• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• Iron Man & YamStore: Powering a Global Phishing-as-a-Service EcosystemMalware2026-10-15
• Inside a brand deal scam targeting YouTube creatorsCampaign2026-10-12
• T-Mobile rewards points expiry texts are a phishing scamCampaign2026-09-17
• Tracking BigBear 2.0 Evilginx2 Phishing CampaignCampaign2026-09-07