Fuck Around and Find Out: How a $6.99 Phishing Scam Got 1.2 Million Fake Victims

A forensic analysis of a phishing SMS campaign impersonating the California DMV, demanding a $6.99 fake traffic violation payment. The operation used a cheap .cfd domain with wildcard DNS on Alibaba Cloud, targeting multiple US states simultaneously. The phishing kit, called Lighthouse, is a commercial phishing-as-a-service platform run by the Smishing Triad, a Chinese cybercrime group operating ~194,000 malicious domains across 74 countries with real-time operator panels for harvesting victim data.