Cybersecurity researchers have revealed the existence of a sophisticated new phishing kit, Xiū gǒu, which has been used in campaigns across Australia, Japan, Spain, the U.K., and the U.S. since at least September 2024. Developed by a Chinese-speaking threat actor, Xiū gǒu has been observed on over 2,000 phishing websites aimed at public sector, postal, digital service, and banking targets, according to a recent report from Netcraft.
The Xiū gǒu phishing kit, equipped with an admin panel and developed using Golang and Vue.js, is designed to steal credentials and other sensitive data from fake phishing pages hosted on the ".top" domain. It also uses Telegram for data exfiltration. Netcraft highlights that threat actors employing Xiū gǒu often rely on Cloudflare’s anti-bot protections to obscure hosting details and avoid detection.
The phishing campaigns primarily use Rich Communications Services (RCS) messages rather than traditional SMS, alerting users to alleged parking fines or failed package deliveries. Recipients are prompted to click on a shortened URL to pay fines or update delivery information. These tactics exploit RCS’s widespread use on both Apple Messages (starting with iOS 18) and Google Messages, as it provides upgraded messaging options like typing indicators, file-sharing, and optional end-to-end encryption (E2EE).
To counter phishing threats, Google recently announced a series of protective measures, including scam detection via on-device machine learning. These models specifically target fraudulent messages involving package delivery and job scams. Additionally, Google is piloting a security warning for users in India, Thailand, Malaysia, and Singapore who receive texts from unknown senders with suspicious links. This security feature, set to expand globally, includes moving messages from unrecognized international contacts to a “Spam & blocked” folder.
Emerging Phishing Campaigns Using Xiū gǒu and Beyond
Other recent phishing threats underscore the evolving landscape. Cisco Talos uncovered a campaign targeting Facebook business and advertising account users in Taiwan, in which threat actors send phishing emails with malicious links to Dropbox or Google Appspot domains. These links trigger a download of malware-laden RAR files disguised as PDF documents, ultimately deploying stealer malware like Lumma or Rhadamanthys. Cisco’s report reveals that these phishing emails impersonate a company’s legal department, demanding urgent action to avoid potential legal consequences.
Meanwhile, a separate campaign identified by Barracuda involves attackers impersonating OpenAI to send phishing emails requesting updates to payment information. The emails, sent from a single domain to over 1,000 recipients, utilized multiple hyperlinks within the email to evade detection systems. Despite passing DKIM and SPF checks, Barracuda flagged the domain as suspicious.
These campaigns serve as a reminder of the need for vigilant security practices and highlight the advanced strategies phishing actors now employ to evade detection and target both individuals and businesses.
