Researchers track surge in high-level Smishing Triad activity

Researchers at Palo Alto Networks’ Unit 42 uncovered a large, China-managed smishing campaign called “Smishing Triad” that has generated roughly 195,000 malicious domains since January 2024. The operation leverages a decentralized ecosystem (domain sellers, phishing-kit developers, data brokers, spammers) to impersonate services across critical sectors—toll roads, postal services, finance, healthcare, law enforcement, and social media—harvesting national IDs, addresses, credentials and financial data via short-lived, frequently changing domains.