Exposing a Smishing campaign across 19 countries: 1,628 malicious URLs tied to a single 128-char HTML fingerprint

A large-scale smishing campaign has been exposed involving 1,628 malicious URLs linked by a unique 128-character HTML fingerprint. This campaign spans 19 countries and uses infrastructure distributed across multiple cloud providers including Tencent Cloud, Alibaba Cloud, Cloudflare anycast, and ALEXHOST Moldova. The campaign targets users via SMS phishing (smishing) with URLs designed to deceive recipients. The detection artifact is a consistent metadata hash found on all phishing pages, facilitating identification. There is no information about active exploitation or patches since this is a threat campaign rather than a software vulnerability.

• hunt.io/blog/massive-smishing-campaign-governments-postal-telecoms (opens in a new tab)
• reddit.com/r/blueteamsec/comments/1tpa7ke/exposing_a_smishing_campaign_across_19_countries/ (opens in a new tab)

• Four Billion Requests: The DDoS Campaign That Followed Our Meta Abuse-Ad ReportingCampaign2026-09-09
• Fake interview -> Crypto theft: Windows campaign analysisCampaign2026-08-14
• OpenAI reports internal model used public recovery phrases to find and spend a funded Sepolia accountNews2026-10-23
• How cybercriminal forum operators responded to PHP2ShellMediumVulnerability2026-10-23
• PHP2Shell Exposure Hunting · Do you have it across your estate and where?? An Advanced Hunting pack for Defender XDRNews2026-10-22