Threat Actors Use Fake Domains to Target Users Through Deceptive URLs

The malicious domains follow carefully crafted naming conventions, often blending legitimate brand names or government services with suspicious subdomains. These domains are designed to visually mimic authentic services, creating a false sense of trust among users. The domains are primarily registered with a specific registrar, and it have observed millions of interactions with these domains, demonstrating the effectiveness of the attackers' methods. Attackers continue to refine their tactics, including cloaking techniques that change the content displayed based on the user accessing the site, making it harder for both users and automated security systems to detect malicious activity.

The rapid expansion of this smishing campaign highlights the increasing use of domain spoofing to deceive users. As the techniques evolve, both individuals and organizations must remain vigilant, implementing proactive measures such as blocking newly registered domains and monitoring for suspicious activity. While traditional defenses may be effective for a limited time, attackers’ use of short-lived domains and cloaking methods presents a growing challenge for systems. Ongoing adaptation and awareness will be crucial in mitigating the impact of these pervasive threats.

THREAT PROFILE:

REFERENCES:

The following reports contain further technical details:

• https://cybersecuritynews.com/threat-actors-registered-26k-domains-mimic-brands/
• https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-04-23-IOCs-for-smishing-activity-update.txt