New PhaaS Platform Phoenix Drives Brand-Impersonation Smishing Across Finance, Telecom, and Logistics

The Phoenix System is a commercial Phishing-as-a-Service platform used since January 2024 to run large-scale smishing campaigns (notably Reward Points and Failed Parcel Delivery lures) across APAC, LATAM, Europe and MEA. Operators buy annual access (around $2,000) via Telegram, use ordinary numbers and BTS injection to bypass carrier filters, and employ geofencing, IP/device filtering and a centralized panel to manage campaigns and harvest credentials; Group-IB linked the same backend to campaigns targeting 70+ organizations and ~1,500 phishing domains.