# DCloud Uni-App Scam Network Powers RainbowEx-Style Crypto Fraud Across 236,000+ Domains

> A global cybercriminal ecosystem has repurposed the legitimate Chinese cross-platform toolkit DCloud Uni-App to mass-produce fake cryptocurrency exchanges, wallet drainers, and WhatsApp phishing kits across more than 236,000 fraudulent second-level domains since 2022. The network, exposed via the 2024 RainbowEx Ponzi scandal in Argentina, spawned copycat operations (LSSC, Yuechi Sharing Technology, XAEL-AI) that drain BNB Chain and Tether wallets from victims across at least eight languages and every continent.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1219
- **ID:** TL-2026-1219
- **Severity:** MEDIUM
- **Category:** FRAUD
- **Status:** ACTIVE
- **Actor:** DCloud Uni-App Scam Network
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since at least mid-2022, threat actors have abused DCloud Uni-App — a legitimate, widely-used open-source cross-platform application development framework built by the Chinese company DCloud — to rapidly scaffold and deploy fraudulent cryptocurrency exchanges, investment 'pig-butchering' platforms, wallet drainers, gambling/prediction-market clones, and messaging-platform (WhatsApp) phishing portals. Infoblox threat intelligence, corroborated by reporting from The Hacker News, GBHackers, SecurityWeek, and CybersecAsia, identified 236,493 distinct second-level domains (SLDs) built on this framework, with roughly 18,000 concurrently visible at peak and around 1,024 hosted on bulletproof infrastructure.

The operation came to international attention through the October 2024 RainbowEx scandal, in which a bogus cryptocurrency exchange defrauded a large share of the population of San Pedro, Argentina, in a Ponzi/investment-fraud scheme; seven people were reportedly arrested in connection with the case. Public disclosure of the RainbowEx-DCloud link (via New York Times coverage) triggered a surge in new scam-domain registration, peaking at roughly 15,000 new DCloud-based scam sites per month.

Operators reuse a nearly identical technical and behavioral playbook across campaigns: a six-field victim registration flow (phone number, password, confirm password, graphic CAPTCHA, SMS verification code, and a gated invitation/affiliate code that prevents signup without an existing recruiter), fabricated trading dashboards showing fictitious gains, stablecoin (primarily Tether/USDT) deposit collection, blocked withdrawals once the scheme is publicly exposed, and last-ditch 'account verification fee' extortion (documented at $75). Wallet-drainer variants (e.g., bepviews.com) impersonate official BNB Chain and Tether verification flows with a 'Verify Asset'/'Connect Wallet' button that authorizes on-chain asset transfer to attacker-controlled addresses. WhatsApp-impersonation phishing kits (faq-whatsapp-center.com, verify-what.com, and a cluster of whats-z*.vip domains) harvest credentials and session data under the guise of a WhatsApp Help Center or account-verification flow.

Distinct campaign families identified include: RainbowEx (Argentine fake exchange, October 2024), Lightning Shared Scooter Co. / LSSC (U.S. mobility-sharing investment pyramid active in 8+ cities through August 2025, prompting FBI/state investigation, individual losses documented above $370,000), Yuechi Sharing Technology Ltd. / YST (active 2026 bicycle/scooter-sharing investment scam targeting Australia, New Zealand, and the U.S.), and XAEL-AI (an AI-investment-narrative variant sharing YST's backend registration/support infrastructure). Operators construct legitimacy through real government business registrations (Hong Kong Companies Registry, U.S. FinCEN MSB registrations), stock footage (e.g., Nasdaq closing-bell ceremony clips), physical storefronts with functioning products (LSSC's scooters), branded/scripted customer-service chat funnels, and even endorsements from local officials.

Infrastructure is predominantly hosted on legitimate cloud providers (Cloudflare, Alibaba Cloud, Tencent Cloud, AWS) to blend with normal traffic — roughly 94% of scam domains resolve to ASNs also carrying legitimate traffic — while a harder-to-disrupt subset (roughly 6%, rising to 14-17% among 'evasive-tier' operators who strip DCloud's default framework fingerprints) sits on bulletproof hosting, dominated by AS152194 CTG Server Limited, a Hong Kong-registered provider listed on the Spamhaus DROP ASN list. Technical fingerprinting relies on DCloud's recognizable default build scaffolding: Android package naming patterns (uni.UNI[hex], io.DCloud.application.DCloudApplication) and manifest components (DCloudApplication, WebviewActivity, WebAppActivity, ProcessMediator), plus a shared 29-language localization pack including uncommon diaspora languages (Haitian Creole, Kinyarwanda, Albanian, Uzbek) used to target migrant and diaspora victim communities globally.

Infoblox observed two centralized infrastructure disruption events — July-September 2025 (visible monthly active SLDs dropped from ~14,000 to under 5,000) and a second beginning late January 2026 — suggesting a small number of centralized operators control large swaths of the ecosystem despite its apparent sprawl. Enterprise DNS telemetry recorded 985 distinct enterprise customers across 25 industry verticals (led by Food & Beverage, Banking, Government, IT Consulting, Education, and Financial Services) generating over 5 million DNS queries to this scam infrastructure, with query volume patterns (no domain exceeding 20,000 queries per customer) suggesting employee personal-device exposure rather than deliberate enterprise targeting.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1589 Gather Victim Identity Information
- T1590 Gather Victim Network Information
- T1593 Search Open Websites/Domains
- T1566 Phishing
- T1189 Drive-by Compromise
- T1598 Phishing for Information
- T1213 Data from Information Repositories
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1036 Masquerading
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1657 Financial Theft
- T1102 Web Service
- T1090 Proxy
- T1567 Exfiltration Over Web Service

## Sources

- [DCloud Uni-App Scam Network Powers RainbowEx-Style Crypto Fraud and WhatsApp Phishing](https://cybersecuritynews.com/dcloud-uni-app-scam-network-powers-rainbowex-style-crypto-fraud/)
- [From San Pedro to Salinas: How a Chinese Framework DCloud Uni-App Powers a Global Scam Economy](https://www.infoblox.com/blog/threat-intelligence/from-san-pedro-to-salinas-how-a-chinese-framework-dcloud-uni-app-powers-a-global-scam-economy/)
- [236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers](https://thehackernews.com/2026/06/236000-dcloud-uni-app-sites-used-in.html)
- [DCloud Uni-App Framework Powers 236,000+ Scam Domains Across Global Fraud Economy](https://gbhackers.com/dcloud-uni-app-framework/)
- [Chinese Framework Powers 200,000 Scam Sites](https://www.securityweek.com/chinese-framework-powers-200000-scam-sites/)
- [Chinese Open-Source Toolkit Powers Global Scam Networks](https://securitymea.com/2026/06/26/chinese-open-source-toolkit-powers-global-scam-networks/)
- [RainbowEx scam template scales to 236,493 domains with workplace spillover](https://cybersecasia.net/news/rainbowex-scam-template-scales-to-236493-domains-with-workplace-spillover/)
- [DCloud Uni-App Templates Help Fraudsters Scale Crypto, Mobility, and Messaging Phishing Scams](https://cyberpress.org/dcloud-templates-scale-phishing/)
- [Chinese Framework Behind 200,000 Scam Sites: Cybersecurity Threat Unveiled](https://www.news4hackers.com/chinese-framework-behind-200000-scam-sites-cybersecurity-threat-unveiled)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1219