The .gov Illusion: Inside the 16,800-Domain “Operation Trust Trap” Campaign

Cyble Research and Intelligence Labs (CRIL) uncovered “Operation Trust Trap,” a large-scale phishing campaign of ~16,800 rapidly rotating domains that mimic government URLs via subdomain trust injection and hyphen manipulation to harvest credentials and payment data; the campaign is US‑centric (targeting state services like DMVs and toll systems) with international lures and an infrastructure hosted on Tencent/Alibaba Cloud, and CRIL observed a cluster consistent with APT36 activity.