# 2 PhaaS 2 Furious — Chinese-Language Phishing-as-a-Service Ecosystem (UNC5814/Darcula, YY Lai Yu, Lighthouse, Lucid, Smishing Triad)

> Google Threat Intelligence Group documented the rapid maturation of a Chinese-language phishing-as-a-service (PhaaS) ecosystem anchored by UNC5814/Darcula (Magic Cat builder), YY Lai Yu, Lighthouse, and Lucid (XinXin group). Operators have shifted from static credential harvesting to real-time OTP/MFA interception via live admin panels, AI-powered cloned phishing pages, mobile-wallet provisioning fraud, RCS/iMessage delivery to bypass SMS carrier filters, and Telegram-based open-air commerce — driving an estimated $15B in annual card-fraud losses across 119+ countries.

- **Published:** 2026-05-25T00:00:00Z
- **Last reviewed:** 2026-05-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0578
- **ID:** TL-2026-0578
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** UNC5814 (China)
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Google Threat Intelligence Group (GTIG) analyst Jamie Collier published '2 PhaaS 2 Furious: The Evolution of Chinese-language Phishing Services' on 25 May 2026, providing the most comprehensive public mapping to date of a Chinese-language phishing-as-a-service (PhaaS) ecosystem that has emerged as a peer rival to the historically dominant Russian-speaking phishing underground. The ecosystem comprises roughly a dozen mature offerings advertised openly on Telegram, including Darcula (operated by UNC5814 and powered by the Magic Cat builder), YY Lai Yu (信箱来鱼), Lighthouse, Lucid (XinXin group / Black Technology, developer LARVA-242), Panda Shop (a Smishing Triad rebrand identified by Resecurity in March 2025), and the Oak Tel / Carrie SMS bulk-messaging gateway. Combined activity has produced an estimated $15 billion in annual fraudulent charges (Krebs / Ford Merrill modelling) and 12.7 to 115 million U.S. payment cards compromised between July 2023 and October 2024 alone.

The defining technical shift GTIG documents is a 'fundamental move away from static password harvesting towards real-time interception and tokenization.' When a victim enters credentials and an OTP into a phishing page, the data is rendered instantly on an attacker-controlled administrative panel; the operator triggers the OTP request on their own device simultaneously, allowing them to capture and replay the code seconds before expiry. The captured credential is then used to provision the victim''s card into Apple Pay or Google Wallet on an operator-controlled device — frequently a rack of mass-created accounts. Once tokenized, the card is used for contactless point-of-sale fraud, ATM withdrawals, and high-value online transactions; the waiting period between card theft and use has compressed from 60-90 days to 7-10 days. Operators additionally relay NFC transactions globally via Android tools such as ZNFC ("Ghost Tap"), advertised for $500/month.

Darcula version 3 (darcula-suite 3.0), released April 2025, integrates AI-driven page generation. Operators provide a target URL; the platform uses Puppeteer and browser automation to clone the legitimate site''s HTML, CSS, JavaScript, and visual elements into a unique phishing template — defeating signature-based detection that relied on static template hashes. Installer is fetched from v3.magic-cat.world/install.sh and pages export as portable .cat-page bundles. Lucid and Lighthouse maintain large template libraries (Lighthouse: 600+ templates, 316 brands, 17,500+ domains spanning 74 countries; YY Lai Yu: 400+ templates as of November 2025 across 119 countries with heavy Japan focus). Delivery is shifted from carrier SMS to Apple iMessage and Google RCS because end-to-end encryption denies server-side link inspection; operators use mass-created Apple IDs with spoofed display names and rotate sending domains. Defenders are forced onto on-device protections.

Infrastructure analysis from Palo Alto Unit 42, Resecurity, and Netcraft shows 68.06% of domains registered through Dominet (HK) Limited (Hong Kong), with bulk volume via Alibaba Cloud Computing and Beijing Lanhai Jiye Technology. Favored TLDs include .top, .vip, .icu, .win, .xin, .cc, .cfd, and .world. Infrastructure aggregates on 43,494 unique IPs heavily concentrated in AS13335 (Cloudflare), particularly 104.21.0.0/16, with AliDNS and Cloudflare nameservers handling 45.6% and 34.6% of resolution. Domains are highly disposable: 29.19% are active for two days or less; 82.6% are gone within two weeks. Brand impersonation spans postal services (USPS, Royal Mail, Sagawa, DHL), toll authorities (E-ZPass, SunPass, FasTrak), tax agencies (IRS, UK government, Michigan.gov), banks (Bank of America, Chase, Citibank, JA Bank), card networks (JCB, Visa, Mastercard via co-brands), telecom (AT&T, Vodafone, Du), and consumer tech (Google with 107 sign-in templates alone, Apple, Amazon, Nintendo, Mercari, PayPay).

Attribution is unusually well-established for this segment. Joint reporting by NRK, Mnemonic, Bayerischer Rundfunk, Le Monde, and OSINT Industries identified UNC5814''s primary operator as Yucheng C., 24, of Henan Province, China, operating under handles ''x66'', ''x667788x'', and ''Darcula''. The Lucid developer is tracked as LARVA-242 within the XinXin / Black Technology group. YY Lai Yu management uses handles ''Jeffrey Carrie'' and ''Very casual''. The Smishing Triad acts as a consumer collective stitching multiple kits into industrial-scale campaigns; one Panda Shop actor was observed dispatching up to 2,000,000 smishing messages per day. Google filed a RICO, Lanham Act, and CFAA complaint in the U.S. District Court for the Southern District of New York in November 2025 against 25 unnamed defendants operating Lighthouse, alleging $1B+ in losses and naming over 17,500 domains. Bloomberg reported a parallel civil action against the Darcula group on 17 December 2025. The ecosystem''s ancillary economy spans PII brokerage, VPS rental, money laundering, IMSI catchers, and spamming services — making takedown a defense-in-depth exercise rather than a single-vector cleanup.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1586.002 Compromise Accounts: Email Accounts
- T1587.001 Develop Capabilities: Malware
- T1588.002 Obtain Capabilities: Tool
- T1608.004 Stage Capabilities: Drive-by Target
- T1566 Phishing
- T1566.002 Phishing: Spearphishing Link
- T1566.003 Phishing: Spearphishing via Service
- T1684.001 Impersonation
- T1036 Masquerading
- T1564 Hide Artifacts
- T1056.003 Input Capture: Web Portal Capture
- T1621 Multi-Factor Authentication Request Generation
- T1111 Multi-Factor Authentication Interception
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [2 PhaaS 2 Furious: The Evolution of Chinese-language Phishing Services](https://cloud.google.com/blog/topics/threat-intelligence/chinese-language-phishing-services)
- [Darcula aka. Magic Cat — urlscan.io threat hunting blog](https://urlscan.io/blog/2026/05/11/CnDarcula/)
- [Google Sues China-Based Hackers Behind $1 Billion Lighthouse Phishing Platform](https://thehackernews.com/2025/11/google-sues-china-based-hackers-behind.html)
- [The Bleeding Edge of Phishing: darcula-suite 3.0 Enables DIY Phishing of Any Brand](https://www.netcraft.com/blog/darcula-v3-phishing-kits-targeting-any-brand)
- [Darcula-Suite Adds AI: Phishing Kits Now More Accessible](https://www.netcraft.com/blog/ai-enabled-darcula-suite-makes-phishing-kits-more-accessible-easier-to-deploy)
- [Darcula and the Magic Cat: How OSINT Unmasked A Phishing Tycoon](https://www.osint.industries/project/darcula-and-the-magic-cat-how-osint-unmasked-a-phishing-tycoon)
- [How Phished Data Turns into Apple & Google Wallets](https://krebsonsecurity.com/2025/02/how-phished-data-turns-into-apple-google-wallets/)
- [China-based SMS Phishing Triad Pivots to Banks](https://krebsonsecurity.com/2025/04/china-based-sms-phishing-triad-pivots-to-banks/)
- [Smishing on a Massive Scale: Panda Shop Chinese Carding Syndicate](https://www.resecurity.com/blog/article/smishing-massive-scale-panda-shop-chinese-carding-syndicate)
- [Smishing Triad is Now Targeting Toll Payment Services in a Massive Fraud Campaign Expansion](https://www.resecurity.com/blog/article/smishing-triad-is-now-targeting-toll-payment-services-in-a-massive-fraud-campaign-expansion)
- [The Smishing Deluge: China-Based Campaign Flooding Global Text Messages](https://unit42.paloaltonetworks.com/global-smishing-campaign/)
- [Lucid PhaaS Hits 169 Targets in 88 Countries Using iMessage and RCS Smishing](https://thehackernews.com/2025/04/lucid-phaas-hits-169-targets-in-88.html)
- [XinXin group offers new dreamy PhaaS platform](https://fieldeffect.com/blog/xinxin-group-new-phaas-platform)
- [Google Looks to Dim Lighthouse Phishing Kit](https://www.darkreading.com/threat-intelligence/google-dim-lighthouse-phishing-as-a-service)
- [Lucid Phishing Tool Exploits Faults in iMessage, RCS](https://www.darkreading.com/threat-intelligence/lucid-phishing-exploits-imessage-android-rcs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0578