Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns

Since January 2025, researchers identified over 2,500 phishing domains targeting more than 70 organizations across financial services, telecommunications, and logistics sectors globally. Two dominant smishing campaigns were discovered: Reward Points phishing impersonating banks and telecom providers, and Failed Parcel Delivery phishing mimicking logistics companies. Despite different themes, both campaigns share infrastructure and utilize the Phoenix System administrative panel, a successor to the Mouse System. This Phishing-as-a-Service platform offers real-time victim monitoring, geofencing, IP-based filtering, and live-phishing interventions to bypass multi-factor authentication. The platform is distributed via Telegram channels for approximately $2,000 annually, providing threat actors with pre-built templates, traffic filtering mechanisms, and real-time victim management dashboards. Attackers potentially leverage fake Base Transceiver Stations to bypass carrier-level filtering and deliver messages app...

• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• Iron Man & YamStore: Powering a Global Phishing-as-a-Service EcosystemMalware2026-10-15
• Disruption Targets Major Chinese-Language Phishing Kits with Japanese FocusCampaign2026-10-14
• FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of LockoutsCampaign2026-10-07