CampaignPublished 24 Oct 2025

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Source AlienVault OTX General

Description

A large-scale smishing campaign, attributed to the China-based Smishing Triad, is targeting global users with fraudulent SMS messages impersonating toll violations and package delivery issues. The campaign has expanded internationally, targeting critical sectors such as banking, healthcare, and law enforcement by using realistic phishing pages to harvest sensitive data. It operates via a decentralized infrastructure with over 194,000 malicious domains registered since early 2024, primarily through a Hong Kong-based registrar. This phishing-as-a-service operation leverages sophisticated social engineering to maximize victim engagement. The campaign poses a significant threat to individuals and organizations worldwide, including European entities, due to the broad targeting and sector diversity. No known exploits in the wild have been reported, but the scale and complexity indicate a persistent and evolving threat. Defenders should focus on advanced SMS filtering, user awareness, and domain monitoring to mitigate risks. The threat is assessed as medium severity given its impact on confidentiality and ease of exploitation without requiring authentication but does not directly affect system availability.

Impact

For European organizations, this campaign poses significant risks primarily to confidentiality and integrity. The theft of sensitive information through smishing can lead to financial losses, regulatory penalties (especially under GDPR), reputational damage, and potential unauthorized access to corporate systems if credentials are compromised. Critical sectors such as banking and healthcare are particularly vulnerable due to the sensitive nature of their data and the trust users place in their communications. Law enforcement impersonation could disrupt public trust and complicate incident response efforts. The widespread use of SMS in Europe for two-factor authentication and customer notifications increases the attack surface. Additionally, the decentralized infrastructure and high volume of malicious domains complicate detection and blocking efforts. While the campaign does not directly impact system availability, the downstream effects of compromised credentials and data breaches could lead to operational disruptions. European organizations may also face challenges in cross-border cooperation to mitigate the threat due to the campaign’s international scope and the use of Hong Kong-based registrars.

Defensive guidance

European organizations should implement multi-layered defenses tailored to smishing threats. This includes deploying advanced SMS filtering solutions that leverage threat intelligence feeds to block messages from known malicious domains and phone numbers. User education campaigns must emphasize the risks of unsolicited SMS messages and train users to verify suspicious communications independently. Organizations should discourage the use of SMS-based two-factor authentication in favor of more secure methods such as hardware tokens or app-based authenticators. Monitoring and analyzing domain registrations related to the campaign can help preemptively block phishing infrastructure. Collaboration with telecom providers to identify and shut down malicious SMS sources is critical. Incident response plans should incorporate smishing scenarios, including rapid containment and notification procedures. Legal and regulatory teams should be prepared to address data breach implications under GDPR. Finally, organizations should consider threat hunting for signs of credential compromise resulting from smishing to mitigate lateral movement and further exploitation.

Summary

The Smishing Triad campaign represents a highly organized and expansive smishing (SMS phishing) operation originating from China, targeting global users with fraudulent messages that mimic legitimate notifications such as toll violations and package misdelivery alerts. Since January 2024, the adversary has registered over 194,000 malicious domains, primarily through a Hong Kong-based registrar, enabling a decentralized and resilient infrastructure to support the campaign. The attackers employ advanced social engineering techniques, crafting highly convincing phishing pages that impersonate trusted services across critical sectors including banking, healthcare, and law enforcement. Victims are lured into divulging sensitive personal and financial information, which can be leveraged for identity theft, financial fraud, or further intrusion attempts. The campaign is likely powered by a phishing-as-a-service (PhaaS) model, allowing widespread distribution and scalability. Although no direct software vulnerabilities or exploits are involved, the threat exploits human factors and the ubiquity of SMS communication. The campaign’s global reach and sector targeting increase the risk to organizations that rely on SMS for customer communication or employee notifications. The absence of a CVSS score reflects the nature of the threat as a social engineering campaign rather than a software vulnerability. The campaign’s complexity and volume of malicious domains underscore the need for coordinated detection and response strategies.

Indicators of compromise

Domains 35

anpost.com-pay.online
anpost.id-39732.info
canpost.id-89b98.com
dhl.de-yiore.store
e-zpass.com-emea.top
e-zpass.com-etcha.win
e-zpass.com-etcoz.win
e-zpass.com-statementzz.world
e-zpass.com-tollbiler.icu
e-zpass.org-qac.xin

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Oct 2025, 11:41 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

Domains 35

Community reviews

Related threats