Beware! Fake Unpaid Tolls Messages Used in Phishing Attack to Steal Login Credentials

A large-scale PhaaS platform called Lucid, attributed to the Chinese-speaking XinXin group, is powering toll-related SMS/iMessage/RCS phishing campaigns that ask victims to reply and then deliver links to phishing sites to steal personal and financial information. The platform offers affiliates customizable templates, domain generation, geo-targeting, anti-detection features, and a monitoring dashboard; researchers report tens of thousands of domains and cross-region targeting. Authorities recommend not replying or clicking links, verifying claims with official toll agencies, reporting spam to 7726, and contacting financial institutions and law enforcement if compromised.