Serbian 'Putevi Srbije' Traffic-Fine Smishing Campaign Using Darcula and Phoenix PhaaS Platforms — Threadlinqs Intelligence
As of 2026-07-01, Serbian 'Putevi Srbije' Traffic-Fine Smishing Campaign Using Darcula and Phoenix PhaaS Platforms is a medium-severity phishing threat attributed to Unattributed cybercriminal fraud operation (Darcula, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1032 · Severity: MEDIUM · Status: ACTIVE · Category: PHISHING
Attribution: Unattributed cybercriminal fraud operation (Darcula · FINANCIAL
A smishing campaign impersonates Putevi Srbije, Serbia's state road authority, sending fake traffic-fine notices with urgency and penalty-increase threats that lead to counterfeit government payment
In a campaign discovered by Group-IB on July 1, 2026, cybercriminals impersonated Putevi Srbije, the Serbian public enterprise responsible for national road infrastructure, to defraud victims via SMS phishing (smishing). Victims receive text messages claiming an outstanding traffic fine, using urgency language warning that the penalty amount will increase if not paid immediately. The message contains a link to a cloned government payment portal built to closely mimic the real Putevi Srbije domain and branding.
The operation is notable for blending infrastructure and toolkits from two separate Phishing-as-a-Service (PhaaS) ecosystems: Darcula, a Chinese-language platform that emerged in 2023 offering 200+ ready-made phishing templates and, in its newer iterations, AI-generated pages, Puppeteer-based browser automation, and iMessage/RCS delivery to bypass SMS firewalls; and Phoenix, a centralized administrative-panel PhaaS platform (linked to Reward Points and Failed Parcel Delivery phishing campaigns since January 2024) that gives operators real-time victim telemetry, geofencing, IP filtering, and live-phishing intervention across localized templates for APAC, LATAM, Europe, and MEA regions.
The phishing pages hosted on both platform's infrastructure use significant client-side evasion engineering: content is Base64-encoded and embedded inside custom, non-standard HTML tags (e.g. z-span, z-strong) rather than plain text, defeating static keyword/signature scanners. The obfuscated content is only decoded and rendered client-side via decodeURIComponent(atob(...)) calls, deferred using requestIdleCallback so decoding happens during browser idle cycles, and gated behind the IntersectionObserver API so text is only decoded once it scrolls into the visible viewport. A recurring 2-second polling loop continuously rescans the DOM for newly injected obfuscated nodes, ensuring dynamically added content is also decoded. The phishing infrastructure additionally sits behind Cloudflare/CDN proxy fronting to obscure the true hosting origin and frustrate takedown attempts.
Once a victim submits payment card data (card number, expiry date, CVV) on the fraudulent portal, the data is harvested directly by the operators for immediate fraudulent purchases, resale on dark web card shops, or follow-up social-engineering scams. Victims typically first learn of the compromise via unexpected bank account charges.
The campaign demonstrates a broader financial-fraud trend of PhaaS interoperability: rather than committing to a single phishing-kit vendor, criminal operators appear to be mixing and matching templates, hosting, and back-end panels from multiple competing PhaaS providers within one operation, complicating attribution and blocklist-based defenses that assume a single infrastructure fingerprint per campaign.
Weaknesses (CWE)
CWE-451, CWE-506, CWE-1021
Target sectors: government administration, transport, finance, consumer citizens
Target regions: serbia, Balkans, Europe, APAC, LATAM, MEA
Detections & IOCs
As of 2026-08-18, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, MEDIUM, threat intelligence, cybersecurity, T1591, T1583, T1587, T1588, T1585, T1608, T1566, T1204, T1027, T1140
