New “Penguin” Platform Sells Pig-Butchering Kits, PII, and Stolen Accounts

The industrialization of pig butchering scams has reached a critical tipping point. A sprawling Pig Butchering-as-a-Service (PBaaS) economy has emerged across Southeast Asia, offering turnkey scam platforms, stolen identities, pre-registered SIM cards, mobile applications, payment infrastructure, and shell company formation services.

PBaaS enable fraudsters to scale romance and investment fraud operations with unprecedented ease and minimal technical expertise.

At the center of this commodified fraud ecosystem are service providers like “Penguin” and “UWORK”, which exemplify how low-cost, off-the-shelf criminal services have transformed pig butchering known in Chinese as sha zhu pan from isolated scam operations into a coordinated, industrial-scale threat.

The PBaaS Supply Chain

The Penguin actor operates an open marketplace selling comprehensive fraud toolkits to scammers.

Among its offerings are shè gōng kù (社工库) literally “social worker database” a code term for stolen personally identifiable information (PII) used to identify and target affluent victims.

Penguin also supplies pre-registered SIM cards to bypass telecom verification, stolen social media accounts from platforms including Tinder and WhatsApp, and Adobe and Apple Developer accounts, and curated “character sets” consisting of stolen photos used to construct fake identities for romance scams.

Beyond stolen data, Penguin addressed Social Customer Relationship Management (SCRM) tools, payment processing services, and distribution channels for fraudulent mobile applications.

These apps are delivered through Android .apk sideloading and iOS .mobileprovision provisioning files, which if approved by victims grant scammers access to device management capabilities.

UWORK, another key player in the PBaaS market, offers a comprehensive customer relationship management and admin platform tailored explicitly for scammers.

UWORK powers fake investment websites such as lion-forex[.]com, providing backend dashboards for agent management, Know Your Customer (KYC) data collection, and operational oversight of multi-agent fraud networks.

The commodification of these criminal services has drastically reduced both costs and technical barriers to entry.

Website templates are available for as little as US$50, while complete fraud operation packages including hosting, apps, CRM systems, and payment rails cost approximately US$2,500.

Additional services include Virtual Private Server (VPS) hosting, MetaTrader platform integration for fake forex trading sites, and company incorporation services with nominee directors to lend fraudulent legitimacy and facilitate money laundering.

This industrialized model enables scammers to achieve high returns on investment while scaling fraud campaigns globally with minimal effort.

MITRE ATT&CK Framework Mapping

The PBaaS model aligns with multiple adversary techniques:

• T1588 (Obtain Capabilities): Purchase of turnkey infrastructure, stolen accounts, and shell companies.
• T1589 (Gather Victim Identity Information): Acquisition of PII databases to profile and target victims.
• T1078 (Valid Accounts): Use of stolen credentials and pre-registered accounts for impersonation.
• T1566 (Phishing): Social engineering via romance and investment scams.
• T1204 (User Execution): Coercion of victims to install malicious provisioning files or sideload apps.

Traditional enforcement efforts focused on dismantling individual scam groups are insufficient.

Defensive strategies must pivot toward disrupting the service providers, financial enablers, shell-company facilitators, DNS infrastructure, and payment rails that underpin the PBaaS economy.

Only by targeting the supply chain can law enforcement and the cybersecurity community effectively dismantle the industrial scaffolding that makes mass pig butchering fraud possible.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.