Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation

Oct 24, 2025Ravie LakshmananData Breach / Cybercrime

The ongoing smishing campaign, attributed to the Smishing Triad, has utilized over 194,000 malicious domains since January 1, 2024, targeting various services globally, as per new research from Palo Alto Networks Unit 42.

Security researchers Reethika Ramesh, Zhanhao Chen, Daiping Liu, Chi-Wei Liu, Shehroze Farooqi, and Moe Ghasemisharif revealed that the attack infrastructure, although registered through a Hong Kong-based registrar and Chinese nameservers, is primarily hosted on popular U.S. cloud services.

The Smishing Triad group, linked to China, is known for inundating mobile devices with fake toll violation and package misdelivery notices to deceive users into sharing sensitive information, resulting in over $1 billion in profits over the past three years.

In a recent report, Fortra highlighted the use of phishing kits associated with the Smishing Triad to increasingly target brokerage accounts for banking credentials and authentication codes, witnessing a significant rise in attacks in the second quarter of 2025 compared to the same period last year.

These attacks involve manipulating stock market prices through ‘ramp and dump’ tactics, leaving minimal traces and heightening financial risks, according to security researcher Alexis Ober.

The Smishing Triad has evolved into a highly active community, encompassing various threat actors who play vital roles in the phishing-as-a-service (PhaaS) ecosystem.

The PhaaS ecosystem of the Smishing Triad

Unit 42’s analysis indicates that a majority of the root domains are registered under Dominet (HK) Limited, with a significant number of domains being active for very short periods, demonstrating a strategy of continuous domain registration to evade detection.

The campaign has utilized a large number of fully qualified domain names (FQDNs) resolving to numerous IP addresses, predominantly in the U.S. and hosted on Cloudflare (AS13335).

The phishing campaigns have impersonated a wide range of services, including banks, cryptocurrency exchanges, mail services, police forces, and more, with a global reach and a highly decentralized nature.

In government service impersonation attacks, users are often redirected to pages claiming unpaid tolls or service charges, sometimes using ClickFix lures to execute malicious code under the guise of completing a CAPTCHA check.

The Smishing Triad’s smishing campaign is extensive and diverse, targeting various sectors and services across different countries, with attackers constantly registering and cycling through new domains to avoid detection.