Beware! Phishing Scam Uses Fake Unpaid Tolls Messages to Harvest Login Credentials

A global smishing campaign uses a phishing-as-a-service platform called Lucid to send fake unpaid toll notifications via SMS, prompting victims to reply and then receive region- and device-specific phishing links; Lucid provides bulk messaging, domain/landing page generation, dynamic targeting, device-specific pages, and anti-detection controls. Researchers observed tens of thousands of domains (primarily hosted in China) and an approximately 5% success rate, with FBI and FTC reports noting a surge in complaints, while other PhaaS platforms (e.g., Darcula, EvilProxy) offer similar capabilities to bypass MFA and evade detection.