Emerging Chinese Phishing-as-a-Service Ecosystem Targets Global Users

The Chinese-language phishing-as-a-service (PhaaS) ecosystem is rapidly evolving, shifting from static password harvesting to real-time credential interception and tokenization. Google Threat Intelligence Group (GTIG) identified a dozen active PhaaS offerings that exploit encrypted messaging protocols like RCS and iMessage to deliver phishing lures, making detection more challenging. These services primarily target non-Chinese entities, with a focus on the general public rather than large organizations. The operators utilize advanced tactics, including live administration panels to capture one-time passcodes (OTPs) and exploit digital wallets for unauthorized transactions. The proliferation of AI tools enhances their capabilities, allowing for localized phishing content and automated operations. Recent legal actions against specific PhaaS providers indicate ongoing efforts to combat this threat. The landscape poses significant risks to users across various countries, including Japan, the US, and Australia.

Key Points: • Chinese-language PhaaS operations have shifted to real-time credential interception techniques. • Phishing services utilize encrypted messaging platforms like RCS and iMessage to evade detection. • Operators are targeting global users, primarily impersonating non-Chinese organizations.