Global Smishing Campaign Exploits Cloudflare Error Pages for Phishing

Group-IB researchers have uncovered a large-scale smishing and phishing operation that has been active since the second half of 2025. This campaign impersonates over 260 brands across 72 countries, primarily targeting mobile users in Latin America. The attackers utilize fake Cloudflare 'Error 524' pages to deceive victims into providing sensitive information. The operation has generated thousands of phishing domains, with a significant concentration in Mexico, Chile, and Colombia. The campaign employs advanced evasion techniques, including geofencing and encrypted WebSocket channels for real-time data theft. Group-IB has identified 4,389 domain instances linked to this operation, with additional targets in Europe, APAC, and North America. The campaign's sophisticated infrastructure poses a significant threat to financial services and telecommunications sectors. Ongoing monitoring and threat intelligence efforts are crucial to mitigate the risks associated with this operation.

Key Points: • The smishing campaign targets over 260 brands across 72 countries, focusing on Latin America. • Attackers use fake Cloudflare 'Error 524' pages to trick victims into revealing personal data. • Group-IB identified 4,389 phishing domains linked to this operation, with a significant presence in Mexico, Chile, and Colombia.