Phishy Business: Unraveling LabHost’s scam ecosystem

Group-IB documents the LabHost criminal ecosystem — a Phishing-as-a-Service (PhaaS) offering that automates phishing site deployment, real-time victim interaction (LabRat), SMS/MMS spam delivery (LabSend), and monetization via a card shop (LabCVV) and refund services (LabRefund). The report links Telegram accounts promoting the service, includes deployment scripts and source-code analysis, lists extensive IOCs (domains, IPs, hashes) tied to active phishing pages targeting Canadian financial services (notably INTERAC), and provides recommendations for detection, takedown, and fraud mitigation.