Phishing Kits Steal Cards, Bind to Apple Pay/Google Wallet via Fake Stores
Chinese phishing groups that inundate users with endless SMS alerts about a “delivery problem” or an “unpaid fine” have unveiled a new seasonal product: turnkey kits for mass-producing counterfeit online storefronts that steal bank-card data and bind those cards to mobile wallets such as Apple Pay and Google Wallet. At the same time, these groups have broadened their lure portfolio — they now distribute messages about fictitious tax rebates and nonexistent bonus points from mobile operators.
Over the past week, thousands of domains have been registered that masquerade as T-Mobile customer portals and promise visitors a generous bonus balance. These links are disseminated through iMessage and RCS, inviting the user to “claim” thousands of points. The phishing site then requests the victim’s name, address, phone number, and card details. Once the card is entered, the site demands a one-time bank code under the pretext of “verifying” a transaction. In reality, the attackers are attempting to bind the card to their own device via Apple Pay or Google Wallet, and the supplied code grants them full control for future fraudulent charges. Similar domains target AT&T customers as well.
According to SecAlliance, multiple China-based groups offering Phishing-as-a-Service have long deployed such schemes across Europe and Asia, but only now are they entering the U.S. market at scale. Domain analyses linked to these operators reveal imitations of state tax-authority websites, promising victims an “unclaimed refund” to extract yet again their card details and one-time authentication codes.
An especially sophisticated vector involves fake online shops. Unlike smishing domains that quickly appear on blocklists, these fraudulent stores do not spam indiscriminately; instead, they lure buyers via Google and Facebook* ads — often by appearing in searches for specific products and “unbeatable prices.” Built using the same Chinese phishing kits, these shops look convincing on the surface but load malicious scripts at checkout. After the victim enters card details, the script attempts to bind the card to the attacker’s mobile wallet. Many victims realize they have been deceived only weeks later, when their order never arrives.
Experts note that such sites can operate undetected for months: they are difficult to identify through bulk scanning and rarely surface in Safe Browsing systems. One of the most effective countermeasures remains promptly submitting received smishing messages and links to services such as smishreport[.]com. A simple screenshot is enough — the algorithm detects patterns and blocks entire series of related domains.
Researchers warn that a year-end surge in smishing is inevitable: amid holiday chaos, people shop online more frequently and scrutinize details less carefully. The danger is amplified by how eagerly scammers exploit any manufactured “urgency” — delayed parcels, account lockouts, and other fictional issues.
To avoid falling prey to such schemes, experts advise resisting the temptation of chasing the lowest price and verifying the reputation of unfamiliar retailers. Newly created domains are particularly risky — simply check their creation date via WHOIS. For suspicious delivery-related messages, it is safer to navigate to the courier’s website manually rather than clicking embedded links. And for any online purchase, carefully review shipping terms, hidden fees, and return policies. Finally, monitoring card statements is essential: the holiday flood of legitimate transactions creates perfect cover for criminals to conceal fraudulent charges among them.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
