Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

China-based smishing and fake e-commerce phishing campaign

Campaign
First reported
Last updated
Happening score
H score 29
1 unique sources, 1 articles

Summary

Hide ▲

A China-based phishing campaign has escalated into mass-registered scam domains and SMS lures for rewards points, tax refunds, and fake retail deals, increasing risk for U.S. consumers during the holiday shopping season. The operation uses iMessage and RCS to deliver links that harvest names, addresses, phone numbers, and payment card data. It then tries to enroll stolen card details into Apple or Google mobile wallets, creating a direct path to unauthorized charges and account abuse.

Related Happenings

GPPStorm Google Partners enrollment phishing campaign

Campaign
H score33 First: 13.07.2026 16:03 Last: 13.07.2026 16:03 Sources 1

About this happening: GPPStorm is a phishing campaign that uses bogus Google Partners and Google Premier Partner enrollment workflows to push recipients to a fake Google sign-in page and st...

Open Happening

Magecart Stripe and Google Tag Manager card-skimming campaign

Campaign
H score36 First: 04.06.2026 23:47 Last: 04.06.2026 23:47 Sources 1

About this happening: The Magecart campaign is abusing Stripe's API infrastructure and Google Tag Manager containers to steal checkout data from Magento/Adobe Commerce stores. The skimm...

Open Happening

AccountDumpling Google AppSheet Facebook phishing campaign

Campaign
H score31 First: 01.05.2026 21:09 Last: 01.05.2026 21:09 Sources 1

About this happening: A Vietnamese-linked operation dubbed AccountDumpling is using Google AppSheet as a phishing relay to steal Facebook credentials, enabling account takeover at scale...

Open Happening

FakeWallet Apple App Store wallet-stealing apps

Malware Activity
H score8 First: 21.04.2026 00:52 Last: 21.04.2026 00:52 Sources 1

About this happening: The FakeWallet app set turned the Apple App Store into a delivery channel for 26 malicious wallet lookalikes, putting crypto holders at risk of account takeover and th...

Open Happening

FakeWallet crypto wallet phishing campaign targeting users in China

Campaign
H score14 First: 21.04.2026 00:52 Last: 21.04.2026 00:52 Sources 1

About this happening: The FakeWallet campaign is actively distributing 26 malicious apps that impersonate crypto wallets and steal seed phrases, putting users in China at immediate risk...

Latest development: 24.04.2026 14:48

Kaspersky said the FakeWallet campaign is gaining momentum with new tactics, including phishing apps published in the Apple App Store, cold wallet impersonation, and phishing notifications, and suspected it may be the work of threat actors linked to SparkKitty because some infected apps use OCR to steal wallet recovery phrases and the two campaigns share native Chinese-speaking operators and cryptocurrency targeting.

Open Happening

Timeline

  1. 05.12.2025 01:02 2 articles · 7mo ago

    China-based phishing campaign widens from package scams to mobile-wallet and fake retail lures

    Campaign Scope Update

    China-based phishing groups are using a broader mobile phishing operation that includes T-Mobile rewards-point lures, AT&T targeting, and U.S. state tax-refund spoofing. The same kits also mass-create fake e-commerce storefronts that collect names, addresses, phone numbers, payment card data, and one-time codes, then attempt to enroll the phished cards in Apple or Google mobile wallets. The phishing messages are delivered through Apple’s iMessage service and Google’s RCS messaging service, and the fake retail sites can be advertised on Google and Facebook and remain hard to detect for long periods.

    Show sources
    Open in new tab