A sophisticated phishing-as-a-service (PhaaS) platform called “Lucid” has been discovered targeting 169 entities across 88 countries. Operated by Chinese cybercriminals known as the “XinXin group” since mid-2023, Lucid employs advanced messaging techniques to bypass traditional security measures.
## How Lucid Works
The platform operates on a subscription-based model, providing customers access to:
– Over 1,000 phishing domains
– Auto-generated phishing websites
– Professional-grade spamming tools
Subscriptions are sold through a dedicated Telegram channel with approximately 2,000 members, with licenses granted on a weekly basis.
## Sophisticated Delivery Methods
What makes Lucid particularly dangerous is its delivery mechanism:
– Sends approximately 100,000 phishing messages daily
– Utilizes end-to-end encrypted channels including Apple iMessage and Android’s Rich Communication Services (RCS)
– Successfully bypasses traditional SMS spam filters
– Operates through large-scale iOS and Android device farms
– Uses temporary Apple IDs for iMessage and exploits carrier-specific implementation flaws for RCS
Security researchers at Prodaft have observed threat actors conducting campaigns from moving vehicles, likely to prevent location tracking by authorities and mobile carriers.
## Targeted Phishing Campaigns
The phishing messages are highly customized:
– Impersonate shipping companies, tax authorities, or toll payment services
– Include appropriate branding and logos
– Use language matching the target demographic
– Implement geo-location filtering
Victims clicking on phishing links are redirected to convincing fake pages impersonating organizations like USPS, DHL, Royal Mail, FedEx, Revolut, Amazon, American Express, and HSBC.
## Protecting Yourself
To avoid falling victim to these sophisticated attacks, never click links in unexpected messages. Instead, log in directly to the actual service through official channels to verify any alerts or bills.
The rise of platforms like Lucid significantly lowers barriers to cybercrime, enabling mass-scale, organized phishing campaigns with higher success rates.