Loading threat actor…
Smishing Triad is a Chinese-speaking, financially motivated cybercriminal ecosystem centered on large-scale SMS phishing and phishing-as-a-service operations. The group has been active since at least 2023 and is widely associated with the Lighthouse platform, as well as related smishing kit activity linked by researchers to Darcula, Lucid, and adjacent tooling. Google has referred to the operators behind Lighthouse as the “Lighthouse Enterprise.” The operation is best known for mass-targeting consumers with fraudulent toll-payment, package-delivery, customs-fee, tax, banking, and government-service lures designed to steal credentials, payment card data, personal information, and other sensitive financial data. The actor operates as an industrialized fraud ecosystem rather than a single tightly centralized team. Reporting consistently describes a decentralized model with specialized roles including phishing-kit developers, domain sellers, hosting providers, data brokers, spammers, and support personnel. Smishing Triad has rented or franchised phishing kits to other criminals, enabling low-skill operators to launch polished brand-impersonation campaigns at scale. Infrastructure tradecraft includes rapid domain churn, bulk domain registration, wildcard DNS, HTTPS certificate automation, host-header routing, mobile-optimized phishing pages, geofencing, browser and header-based filtering, and selective redirection to legitimate sites for non-targets or researchers. Campaign delivery has used SMS, iMessage, RCS, and earlier email-to-SMS abuse, helping messages bypass traditional carrier filtering. Victim-facing lures commonly impersonate postal and parcel services, toll-road operators, tax agencies, law enforcement, banks, payment platforms, e-commerce brands, social media services, and public-sector entities. The U.S. Postal Service and toll-service brands are among the most heavily impersonated themes, but the group’s activity is global and has also targeted transportation, logistics, financial, and government-related services in regions including the United States, the United Arab Emirates, Singapore, Egypt, Europe, and other countries. Researchers have also linked the ecosystem to campaigns against brokerage and financial accounts, with stolen data used for downstream fraud including payment-card abuse and other monetization schemes. Smishing Triad’s core capabilities are credential theft and financial-data harvesting through spoofed web portals, followed by backend exfiltration and reuse of stolen information. Multiple investigations describe large-scale exfiltration of victim-submitted data, extensive use of fake payment pages, and operational resilience through short-lived infrastructure that is frequently replaced after suspension. Public reporting and civil litigation have attributed more than one million victims across over 120 countries to Lighthouse-enabled activity. Overall, Smishing Triad represents one of the most prominent contemporary Chinese-origin smishing and phishing-as-a-service ecosystems focused on global consumer fraud and payment-card theft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
84 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates a franchised smishing platform that rents out ready-made phishing kits for toll, postal, banking, and brand impersonation scams, enabling large-scale SMS/iMessage/RCS fraud campaigns worldwide.
A phishing-as-a-service smishing ecosystem targeting UAE and Singapore government, transportation, and logistics services for financial fraud, credential harvesting, payment card theft, and possible compromise of digital identity platforms such as UAE Pass.
Large-scale phishing-as-a-service and SMS smishing operation using the Lighthouse phishing kit, state-impersonating domains, Telegram-based exfiltration, and evolving infrastructure including a Javalin/Kotlin-based phishing kit.
Conducts large-scale smishing/phishing campaigns (e.g., E‑ZPass-themed lures) using impersonation tactics to steal funds/credentials and facilitate cryptocurrency-related fraud.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.