The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
Summary: Unit 42 attributes an ongoing smishing campaign of fraudulent toll violation and package misdelivery notices to the Smishing Triad, targeting U.S. residents since April 2024 and expanding globally. Using its intelligence framework, Unit 42 identified 194,345 fully qualified domain names across 136,933 root domains registered on or after January 1, 2024, with 68.06% registered through Hong Kong-based registrar Dominet (HK) Limited and hosting concentrated on U.S. cloud services.
Key Takeaway: The U.S. Postal Service is the single most impersonated service with 28,045 FQDNs, and toll services as a category account for nearly 90,000 phishing domains, while 71.3% of domains stay active less than a week - a churn rate that makes blocklist-based detection a losing game.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026