Chinese Gang Behind Smishing Campaign in US

In a recent surge of cybercriminal activity, a China-based threat group known as the "Smishing Triad'' have launched a sophisticated iMessage smishing campaign targeting US citizens. Leveraging compromised Apple iCloud accounts, the gang uses fraudulent package delivery messages to extract personal and financial details from unsuspecting victims.

Cybersecurity firm Resecurity unearthed this malicious campaign, revealing that the Smishing Triad is capable of impersonating reputable postal and delivery entities such as the USPS, Royal Mail, Correos, New Zealand Post, Postnord, J&T Express, and Italy's Poste Italiane and Revenue Service.

The detailed analysis showed that the attackers use compromised iCloud accounts to deliver package delivery failure alerts, urging recipients to click on embedded links to solve the issue. To make the alert seem more credible, the attackers acquire and use the billing or location information of their target, showing a package en-route to their address on a fake page impersonating the delivery service.

When users receive a message from these seemingly legitimate services, they're often prompted to provide additional information or pay delivery fees via credit card. After obtaining these credentials, the cybercriminals can easily commit identity theft and financial fraud.

Central to their strategy is exploiting users' trust in SMS and iMessage. As most individuals are more likely to consider messages received through these methods as credible compared to emails, the success rate of these scams is notably high.

What amplifies concerns about the Triad's activities is their ongoing venture into providing "fraud-as-a-service”. The group sells smishing kits through Telegram channels for a monthly fee of $200. These kits come with ready-to-use tools that allow for easy replication of prominent postal services across the world. It enables even novice cybercriminals to deploy advanced smishing attacks.

The intelligence team at Resecurity reverse-engineered one of the smishing kits offered by the Triad, unearthing an SQL injection vulnerability. This vulnerability facilitated the retrieval of over 108,000 victims' data, showcasing this operation's vast scale and harm.

In response to the escalating threat, the US population in particular should exercise caution. Key recommendations include verifying message senders and refraining from clicking links from untrusted sources. As smishing continues to evolve, it’s imperative for everyone to remain vigilant and prioritize their digital safety.