Loading threat actor…
Smishing Triad is a China-based, Chinese-speaking, financially motivated cybercrime ecosystem active since at least 2023. It operates a decentralized phishing-as-a-service model, supplying phishing kits, brand-impersonation templates, website deployment tools, messaging infrastructure, and support to criminal operators. Its campaigns target consumers worldwide, particularly through fraudulent postal-delivery, unpaid-toll, billing, and account-verification notices. Impersonated organizations also include banks, government agencies, retailers, telecommunications providers, technology platforms, and healthcare services. The ecosystem distributes high-volume phishing messages through SMS, Apple iMessage, and Android RCS. Messages use urgency and plausible small payment demands to direct recipients to counterfeit mobile-friendly websites that collect identity information, payment-card details, banking credentials, passwords, PINs, and one-time passcodes. Stolen credentials are used to access accounts and facilitate financial theft. Operators localize templates to victims’ regions and service providers, rapidly rotate disposable domains and hosting infrastructure, and employ evasion features to reduce exposure to blocking and browser warnings. Kits are marketed and supported through Telegram and other online channels. Lighthouse is a prominent phishing-as-a-service offering associated with Smishing Triad; Google calls the enterprise behind this offering the Lighthouse Enterprise. Darcula and Lucid are associated platforms within the broader, loosely connected ecosystem rather than interchangeable names for a single operator. The operator cluster Outsider is associated with Smishing Triad and uses the reusable JWR phishing kit. JWR captures form-field changes before submission and uses persistent WebSocket communications for real-time exfiltration and operator-directed phishing workflows, with HTTP polling as a fallback. Operators can dynamically request additional card details, PINs, or authentication codes. In November 2025, Google filed a civil lawsuit against 25 unnamed individuals associated with Lighthouse, seeking to disrupt its infrastructure. Smishing Triad activity continued into 2026.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
131 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as an example of phishing-related TLD abuse, using .top domains in SMS lures impersonating toll and postal services.
Broader smishing ecosystem associated in this reference with the Outsider operator cluster and its JWR phishing-kit activity.
A broader smishing ecosystem with which the Outsider operator cluster is associated.
Smishing Triad est l’écosystème cybercriminel auquel le cluster Outsider, opérateur du kit de phishing JWR, est rattaché dans cette campagne de smishing.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.