China-based SMS Phishing Triad Pivots to Banks
Summary: The China-based Smishing Triad, a loosely federated group of phishing-as-a-service operators tracked by Resecurity, Prodaft and SilentPush, has shifted from impersonating toll road and shipping brands to selling kits that target customers of CitiGroup, MasterCard, PayPal, Stripe, Visa and banks in Canada, Latin America, Australia and Asia-Pacific. SilentPush counted roughly 25,000 active phishing domains in any 8-day period across at least 121 countries, mostly hosted at Tencent and Alibaba, with more than a million visits to phishing pages in a 20-day span and a claimed success rate near five percent.
Bottom line: The kits work because banks still send one-time codes by SMS to confirm a card being added to an Apple or Google wallet, and a captured code puts the card into a wallet on a phone the phishers control - one observed site pulled 30 credit card records from 550 victim interactions in seven days.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026