Chinese-Backed Smishing Services Use OTT Messaging and SMS to Scale Credential Theft

**Executive summary:** Chinese-language Phishing-as-a-Service (PhaaS) platforms are enabling large-scale, cross-border credential theft campaigns via SMS smishing and OTT messaging (iMessage, RCS), using phishing kits, affiliate models, and SIM box infrastructure to evade detection and rapidly scale attacks against banks, postal services, and government-related targets worldwide.