Error 524 Decoy Campaign Uses Brand Impersonation to Phish Mobile Users

Gbhackers •Mayura Kathir • June 3, 2026

A large-scale smishing and phishing campaign argeting mobile users worldwide by impersonating more than 260 brands across 72 countries, leveraging a sophisticated evasion technique built around fake Cloudflare “Error 524” pages. Active since the second half of 2025, the operation primarily focuses on Latin America but has expanded into Europe, APAC, and North America, highlighting […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Global Smishing Campaign Exploits Cloudflare Error Pages for Phishing Group-IB researchers have uncovered a large-scale smishing and phishing operation that has been active since the second half of 2025. This campaign impersonates over 260 brands across 72 countries, primarily targeting mobile users in Latin America. The attackers utilize fake Cloudflare 'Error 524' pages to deceive victims into providing sensitive information. The operation has generated thousands of phishing domains, with a significant concentration in Mexico, Chile, and Colombia. The campaign employs advanced evasion techniques, including geofencing and encrypted WebSocket channels for real-time data theft. Group-IB has identified 4,389 domain instances linked to this operation, with additional targets in Europe, APAC, and North America. The campaign's sophisticated infrastructure poses a significant threat to financial services and telecommunications sectors. Ongoing monitoring and threat intelligence efforts are crucial to mitigate the risks associated with this operation. 2 sources 67

Extracted Entities

Error 524 Decoy Campaign Uses Brand Impersonation to Phish Mobile Users

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

MITRE ATT&CK (1)