Smishing Kit Rebounds After Major Takedown

Researchers say a “phishing-as-a-service” kit called Outsider kept generating new scam pages even after a major law-enforcement and industry takedown. The kit supports SMS-based lures that impersonate trusted brands and can capture payment details and MFA codes in real time using adversary-in-the-middle capabilities.

Key findings

• Outsider (operated by “ChenLun”) continued operating after a coordinated takedown, with “more than 700 additional domains” observed after the disruption.
• The kit provides “267 ready-made phishing templates” across multiple sectors and is “delivered through SMS” and managed via a “Telegram ecosystem.”
• A documented smishing example impersonated Singapore’s LTA and used urgency plus tips to bypass phone spam filters, then collected vehicle and phone data and pushed victims to fraudulent payment pages.
• The kit includes AiTM features and “live communication” (WebSockets) so operators can prompt for MFA challenges and capture entered data in real time, including partial form entries.
• Captured data can include “bank credentials, PayPal information and authentication codes,” enabling account takeover and payment fraud.

Who’s being targeted

• Commonly targeted roles: All employees, Finance and accounts payable, Executives, IT/Helpdesk, Security team, Employees who manage fleet/transport or pay tolls/fees.
• Affected industries: Government and transportation authorities, Financial services, Brokerage firms, Telecommunications providers, Postal services, Toll systems, Online payments.
• Attack channels: smishing, website.
• Impersonated: Singapore Land Transport Authority (LTA), A trusted brand portal (template-based phishing page).

Awareness takeaways

• Treat SMS links as high-risk, especially messages claiming urgent issues, verify through the official app or official website instead of tapping message links.
• Be suspicious if a message tells you how to bypass your phone’s spam protections, this is a strong sign of a scam.
• Never enter MFA codes or authentication codes into pages reached from unexpected messages; attackers can capture them live to break into accounts.
• Phishing infrastructure can quickly regenerate after takedowns, so organizations should continuously monitor for brand impersonation and new malicious pages/domains.

Red flags to watch for

• Creates urgency around an “issue” and pushes immediate action via a link
• Unusual guidance to bypass the phone’s spam filtering
• Asks for sensitive identifiers (vehicle registration, phone number) and payment details via a linked portal
• Unexpected MFA prompts on a page reached via a message link
• Repeated requests to re-enter details or provide additional payment information
• Authentication codes requested in the same flow as payment/identity data