Victims clicking on the phishing links are redirected to fake landing pages impersonating state government toll and parking agencies or private entities, such as USPS, DHL, Royal Mail, FedEx, Revolut, Amazon, American Express, HSBC, E-ZPass, SunPass, Transport for London, and more. In a video shared by Prodaft, you can see threat actors conducting phishing campaigns from moving cars, likely to increase operational security and prevent law enforcement and mobile carriers from pinpointing their location. The mobile phishing messages typically impersonate shipping, tax alerts, or missed toll payments, featuring custom logos/branding, the appropriate language to match the target demographic, and geo-location victim filtering. A phishing-as-a-service (PhaaS) platform named 'Lucid' has been targeting 169 entities in 88 countries using well-crafted messages sent on iMessage (iOS) and RCS (Android). Platforms like Lucid lower the barrier of entry to cybercrime operations and grant a certain level of quality to phishing attempts that increase the chances of success for the attackers. The threat group claims to send 100,000 smishing messages daily via Rich Communication Services (RCS) or Apple iMessage, which are end-to-end encrypted, allowing them to evade spam filters. "The platform employs an automated attack delivery mechanism, deploying customizable phishing websites distributed primarily through SMS-based lures," explains Prodaft. The phishing pages are designed to steal personal and financial information, including full names, email addresses, physical addresses, and credit card details. When this is combined with an extensive and resilient infrastructure, threat actors can leverage it to perform mass-scale and highly organized phishing campaigns. Prodaft researchers note that XinXin has also been using the Darcula v3 platform for its operations, which indicates a potential connection between the two PhaaS platforms. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 31 Mar 2025 18:50:03 +0000