Chinese-Backed Smishing Services Scale Credential Theft via OTT and SMS

Key Takeaways

• Chinese-backed smishing services are conducting widespread credential theft campaigns globally.
• These operations leverage both traditional SMS and Over-The-Top (OTT) messaging platforms like Apple iMessage and RCS.
• The campaigns are highly organized, utilizing Phishing-as-a-Service (PhaaS) models and sophisticated SIM box infrastructure to evade detection.
• Victims worldwide are targeted with localized phishing lures designed to mimic legitimate organizations.

A new wave of highly organized smishing campaigns, originating from Chinese-language services, is aggressively targeting individuals globally, leveraging both conventional SMS and modern Over-The-Top (OTT) messaging applications to harvest personal and financial credentials. These sophisticated operations represent a significant and evolving threat within the current cyber landscape, extending far beyond localized attacks.

The rise of Phishing-as-a-Service (PhaaS) has fundamentally transformed the methodology of cybercrime. Instead of developing their own malicious tools, threat actors now rent comprehensive phishing kits. These kits typically include pre-designed templates, backend management panels, and even technical support, democratizing the ability to launch complex attacks.

Chinese-language PhaaS platforms have rapidly emerged as dominant facilitators in this ecosystem. They empower individuals, even those with limited technical expertise, to orchestrate large-scale credential theft operations that simultaneously target victims across numerous countries.

The Modus Operandi: Blending SMS and OTT Messaging

Researchers at urlscan.io published findings on April 27, 2026, detailing several of the most active Chinese-language PhaaS ecosystems. Their analysis reveals that these services strategically employ a combination of SMS-based smishing and OTT messaging platforms, including Apple iMessage and Rich Communication Services (RCS). This multi-channel approach significantly broadens their reach to potential victims.

By using legitimate messaging channels, these attacks become considerably more challenging to detect and block by security measures. This tactic substantially increases the success rate of each campaign launched by the attackers.

Industry data from organizations such as APWG and Microsoft corroborates a sharp increase in domain registrations associated with these frameworks, alongside a surge in phishing kit deployments and the overall volume of phishing scans globally. Cybersecurity firms including Group-IB, Resecurity, and GSMA have all documented the rapid expansion of these ecosystems. They note that these operations often utilize affiliate-based business models, mirroring those found in legitimate software industries. The rapid proliferation of these platforms strongly indicates that a substantial portion of global SMS-based credential theft activity can be directly or indirectly attributed to Chinese-language PhaaS operations.

A key factor in the effectiveness of these services is their capability to conduct cross-border campaigns without requiring extensive changes to their core infrastructure. A single backend platform can support dozens of phishing page templates, meticulously designed to mimic a wide array of legitimate entities, including banks, postal services, toll payment systems, and government agencies in various countries. This adaptability allows a single operator to target victims in diverse geographies like the United States, the United Kingdom, Australia, and Japan within the same campaign window. As the financial incentives for such operations grow, more threat groups are developing and adapting similar frameworks, fostering a competitive underground market that shows no signs of abatement.

How SIM Box Infrastructure Scales the Attack

A critical delivery mechanism underpinning these widespread campaigns is the sophisticated use of SIM box infrastructure for high-volume fraudulent message dissemination. A SIM box is a specialized device housing multiple physical SIM cards, connected to the internet. This setup enables it to send a vast number of SMS messages that appear to originate from ordinary mobile numbers, rather than identifiable commercial bulk-sending platforms. This method significantly enhances the likelihood of messages bypassing conventional spam filters and carrier-level detection systems, which are typically designed to flag mass transmissions from known commercial gateways.

Threat actors behind these operations frequently deploy SIM box networks across multiple countries. This distributed approach helps to evenly distribute the message sending load and prevent the creation of clear, easily detectable patterns. While law enforcement agencies and telecommunications regulators have identified this infrastructure in various investigations, the inherently distributed nature of these setups makes complete takedowns exceptionally difficult. When a single node is neutralized, operators quickly pivot to new SIM card supplies and alternative routing paths, ensuring campaign continuity with minimal disruption.

What You Should Do

• Exercise Extreme Caution: Never click on links in unsolicited SMS or OTT messages, especially those requesting personal information, login credentials, or payment details.
• Verify Through Official Channels: If a message appears official but arrives unexpectedly via a mobile messaging app, independently verify its legitimacy using official contact information (e.g., calling the organization directly, visiting their official website). Do not use contact details provided in the suspicious message.
• Enable Multi-Factor Authentication (MFA): Implement MFA on all accounts that support it to add an extra layer of security, even if your credentials are compromised.
• Report Suspicious Messages: Report smishing attempts to your mobile carrier and relevant cybersecurity authorities to help in tracking and mitigating these campaigns.
• Organizational Monitoring: Security teams should actively monitor for newly registered domains that imitate known brands within their industry. Early detection of phishing infrastructure can significantly disrupt a campaign before it reaches a large number of potential targets.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.