Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns

### Executive summary: Group-IB documents a global smishing campaign ecosystem centered on the commercial "Phoenix System" PhaaS that enables scalable SMS phishing against banks, telcos, and logistics firms; the report details attack flows (reward-points and failed-parcel lures), advanced delivery methods (including potential rogue BTS SMS injection), geofencing and crawler interception, live OTP interception to bypass MFA, shared infrastructure and over 2,500 phishing domains, and provides network IOCs and mitigation recommendations.