Thursday, May 8, 2025
HomeCyber CrimeSmishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Published on

SIEM as a Service

Follow Us on Google News

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.

Resecurity researchers have recently revealed that the Smishing Triad group has launched a fresh smishing campaign targeting Pakistani mobile users.

The gang members send harmful messages pretending to be Pakistan Post via iMessage and SMS in an attempt to steal personal and financial information.

- Advertisement - Google News

These continue their previous operations in the:–

  • USA
  • EU
  • UAE
  • KSA

Following recent data breaches, the crew is estimated to be sending 50,000-100,000 automated daily smishing messages, using stolen dark web databases containing the phone numbers of Pakistani citizens.

Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot

Technical Analysis

This huge operation points out that telecom firms should improve their capabilities for identifying fraud and taking a proactive approach by stopping this malicious activity from occurring continuously against clients.

Smishing message (Source – Resecurity)

The Smishing Triad has spread its smishing operations into Pakistan, sending malicious messages claiming to be from Pakistan Post to steal mobile users’ personal and financial information.

Using stolen local phone number databases, the actors send a maximum of 100,000 smishing texts daily, using URL shorteners and QR codes to avoid detection.

Some serve as validation tactics for targeted attacks on active users.

Fake message from Pakistan Post (Source – Resecurity)

The actors exploit these recent data breaches that have exposed Pakistani citizens’ data to pose as legitimate local firms asking for payment details.

This resulted in PKCERT releasing a security advisory on March 27th, 2020, regarding this widespread campaign targeting major Pakistani carriers.

In addition to Pakistan Post, the group also impersonates courier services with fake delivery scams, which shows how their smishing tactics continue evolving across different countries.

Fake Pakistan Post Payment Page (Source – Resecurity)

Besides this, the Smishing Triad group is still attacking victims from all over the world.

They have various hosts and domain names mapped to the same IP address 23.231.48.129 for their smishing kits.

The actors, in addition to impersonating Pakistan’s postal services, recently targeted Correos, Spain’s state-owned postal provider, confirming their previous activities in July 2023.

This shows that the gang keeps operating all the time on a large scale and changing ways of conducting smishing attacks against postal and delivery services across regions like Pakistan and EU.

Mitigations

Here below we have mentioned all the provided mitigations:-

  • Be Skeptical
  • Don’t Respond
  • Verify the Source
  • Don’t Click on Links
  • Use Security Software
  • Report Suspicious Messages
  • Educate Yourself

IOCs

Domain Names:-

  • ep-gov-ppk[.]cyou
  • pk-post-goi[.]xyz
  • pak-post[.]com/id
  • pakpotech[.]top/id

URLs:-

  • l[.]ead[.]me/bf6fB8
  • is[.]gd/bpEPk3
  • l[.]ead[.]me/BjsT
  • is[.]gd/8vcwYW
  • 2h[.]ae/nwxP
  • 2h[.]ae/cNRd
  • ytfrt[.]top/id
  • linkr[.]it/4bStpB
  • qrco[.]de/bf56c0

Phone Numbers:-

  • +923361021455
  • +923301956704
  • +923315640313
  • +601128430746
  • +923301956704
  • +923328862313
  • +923121461238

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Cisco IOS, XE, and XR Vulnerability Allows Remote Device Reboots

 Cisco has issued an urgent security advisory (cisco-sa-twamp-kV4FHugn) warning of a critical vulnerability in...

OpenCTI: Free Cyber Threat Intelligence Platform for Security Experts

OpenCTI (Open Cyber Threat Intelligence) stands out as a free, open source platform specifically...

LockBit Ransomware Group Breached: Internal Chats and Data Leaked Online

The notorious LockBit ransomware group, once considered one of the world’s most prolific cyber...

Cisco IOS XE Wireless Controllers Vulnerability Lets Attackers Seize Full Control

A critical security flaw has been discovered in Cisco IOS XE Wireless LAN Controllers...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Cisco IOS, XE, and XR Vulnerability Allows Remote Device Reboots

 Cisco has issued an urgent security advisory (cisco-sa-twamp-kV4FHugn) warning of a critical vulnerability in...

OpenCTI: Free Cyber Threat Intelligence Platform for Security Experts

OpenCTI (Open Cyber Threat Intelligence) stands out as a free, open source platform specifically...

LockBit Ransomware Group Breached: Internal Chats and Data Leaked Online

The notorious LockBit ransomware group, once considered one of the world’s most prolific cyber...