Smishing Triad

THREAT ACTOR PROFILE

Smishing Triad

Smishing Triad is a China-based cybercrime operation that runs industrialized SMS phishing (smishing) at global scale. It impersonates toll agencies, postal services, banks and government bodies, delivering phishing links over iMessage and RCS to steal payment-card and personal data, and it sells its phishing kits to other actors as a phishing-as-a-service business.

Country:

China

Financial / eCrime

First seen

2023

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

The Smishing Triad operation

Smishing Triad is tracked under its own name as a China-based cybercrime cluster. It maps to one entry among the the cybercrime groups we track, and its large-scale phishing and fraud tradecraft overlaps with social-engineering crews like Scattered Spider.

GROUP PROFILE

Industrialized smishing as a service

Smishing Triad is a profit-driven operation built for volume. It runs smishing campaigns across more than a hundred countries, rotating through enormous numbers of look-alike domains, and franchises its kits so affiliates can run their own campaigns.

Our record places its origin as China and ties it to large-scale SMS phishing and fraud. Unit 42 documented the group registering more than 194,000 malicious domains since January 2024, with campaigns impersonating toll and package-delivery services in the US.

The group's tradecraft uses iMessage and RCS to bypass carrier SMS spam filters, geo-fencing, short-lived domains on abused TLDs, and kits like Lighthouse and the Panda Smishing Kit sold through Telegram.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Mass smishing into credential and card theft

The stages below come from Smishing Triad activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

Lighthouse, Panda and phishing-as-a-service

Initial Access

CVES EXPLOITED

Social engineering, not CVE exploitation

Smishing Triad relies on mass SMS phishing and credential-harvesting pages rather than exploiting software vulnerabilities, so this profile does not list a confirmed exploited-CVE set. Detection should focus on the look-alike smishing domains, the iMessage and RCS delivery, and the Lighthouse and Panda phishing kits.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Toll scams and global smishing infrastructure

Recent reporting tracks the group's campaigns and kits.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through