Loading threat actor…
Outsider is a China-linked phishing-as-a-service enterprise active since 2023 that provides phishing kits, hosted infrastructure, and operational support to cybercriminal customers. The operation is associated with large-scale SMS phishing campaigns and brand impersonation activity targeting individuals and businesses across at least 55 countries, including the United States. Security reporting and law-enforcement actions describe Outsider as a multi-group criminal ecosystem with specialized roles including phishing-kit development, target-data brokerage, bulk message delivery, monetization of stolen data, and Telegram-based coordination and customer support. Outsider’s service has been used to impersonate trusted brands, telecom providers, government services, and commercial organizations through thousands of fraudulent websites and large volumes of smishing messages. The platform enabled theft of payment card data, bank credentials, account credentials, and other personal information. Reported platform features include prebuilt phishing templates, hosted landing pages, campaign tracking, and mechanisms to solicit multi-factor authentication inputs such as SMS codes, PINs, email-based codes, and app-based verification, improving operators’ ability to bypass authentication controls. The enterprise has also been described as AI-enabled. Operators and customers allegedly used Gemini and other AI tools to generate or refine phishing lures, localized text, and website code, increasing the scale, speed, and adaptability of campaigns. Outsider has been linked to millions of scam messages, thousands of phishing sites, millions of stolen payment card records, and very large financial losses. It has been publicly characterized as a Chinese or China-based cybercrime network rather than a state-sponsored espionage actor. Known aliases directly supported here are limited to Outsider; the broader operation has also been referred to as the Outsider Enterprise.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Large-scale SMS phishing and scam infrastructure operation using AI tools to generate and support fake websites impersonating telecom companies, government services, and commercial brands in order to steal payment card details, credentials, and personal information.
China-based phishing-as-a-service cybercrime operation providing phishing kits, hosted infrastructure, and AI-assisted tooling to enable large-scale credential theft and payment card fraud against victims in dozens of countries.
Chinese cybercrime network accused of developing and managing the Outsider phishing-as-a-service kit and conducting large-scale SMS phishing campaigns impersonating trusted brands to steal personal and financial information from Americans.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.