THU 02 JUL 2026 · GMT EDITION A WHITESTONE INTELLIGENCE PUBLICATION
MARKETS · CYBER · MEMOS · MODELS
DAILY ISSUES26 MAY27 MAY28 MAY29 MAY30 MAY31 MAY01 JUN02 JUN03 JUN04 JUN05 JUN06 JUN07 JUN08 JUN09 JUN10 JUN11 JUN12 JUN13 JUN14 JUN15 JUN16 JUN17 JUN18 JUN19 JUN21 JUN22 JUN23 JUN24 JUN25 JUN26 JUN27 JUN28 JUN29 JUN30 JUN01 JUN02 JUNALL ›
FRONT PAGE / CYBER / CYB-2026-05-25-F2
CYBER · ransomware threat groups · 2026-05-25SCOOP 55

GTIG maps maturing Chinese-language phishing-as-a-service ecosystem rivaling Russian-speaking market

Google Threat Intelligence Group's May 25 report analyzes a dozen current phishing-as-a-service offerings in the Chinese-language underground, all mature services and many likely tied to the broader criminal ecosystem in.

·FILED 2026-05-25·1 MIN READ·RE-VERIFIED 2026-07-02 UTC·✓ RE-VERIFIED 2026-07-02

At a glance

  • GTIG analyzed a dozen mature Chinese-language PhaaS offerings, many likely tied to the broader regional criminal ecosystem
  • The Chinese-language PhaaS ecosystem is rapidly growing as a rival to the historically dominant Russian-speaking market, per GTIG

VERDICT — CONFIRMED

pipeline-backfill confidence · primary + corroborating sources verified · re-verified 2026-07-02 UTC
Cyber desk illustration
Generated desk illustration · The Dossier Wire · not a photograph

Google Threat Intelligence Group's May 25 report analyzes a dozen current phishing-as-a-service offerings in the Chinese-language underground, all mature services and many likely tied to the broader criminal ecosystem in the region — a fast-growing rival to the historically dominant Russian-speaking PhaaS landscape. Per GTIG, these services lower the barrier to entry for Chinese cybercriminals and reveal broader patterns in the evolution of social engineering and credential theft. The report notes Google took legal action against one PhaaS provider late last year and has since worked to endorse related legislation.

Key facts on file

  • GTIG analyzed a dozen mature Chinese-language PhaaS offerings, many likely tied to the broader regional criminal ecosystem
  • The Chinese-language PhaaS ecosystem is rapidly growing as a rival to the historically dominant Russian-speaking market, per GTIG

PRIMARY SOURCE

cloud.google.com
— (2026-05-25) · fetched at filing · archived at publication
Filed underPHISHING

Sources · two-source rule

PRIMARYcloud.google.com— (2026-05-25)
Share
Filed by the Cyber desk · verified by the verification desk · re-verified 2026-07-02 · Our standards: the two-source rule ›
CITE THIS FILE — The Dossier Wire · cyb-2026-05-25-f2 · filed 2026-05-25 · https://thedwire.com/wire/cyb-2026-05-25-f2-gtig-maps-maturing-chinese-language-phishing-as-a-service.html · Primary and corroborating sources listed above; archived at publication. Republishing & licensing: hello@thedwire.com.
More from Cyber FULL DESK ›
Cyber desk illustration
Generated desk illustration · not a photograph
CYBER · SCOOP 58

Congress demands answers as CISA struggles to contain GovCloud credential leak

KrebsOnSecurity reported May 22 that lawmakers in both houses of Congress are demanding answers from CISA following the outlet's report that a contractor intentionally published AWS GovCloud keys and a vast trove of agency secrets on a public GitHub account. Per the report, the congressional inquiry comes as CISA is still struggling to co

✓ verifiednewSOURCE ↗
READ THE FILE ›
Microsoft Patches Actively Exploited Defender Zero-Days After 'Nightmare-Ec
BleepingComputer / Microsoft
CYBER · SCOOP 79

Microsoft Patches Actively Exploited Defender Zero-Days After 'Nightmare-Eclipse' Dumps Windows Exploits; Researcher Accounts Wiped

On May 20, 2026, Microsoft released patches for two actively exploited Microsoft Defender zero-days: CVE-2026-41091 ('RedSun'), a privilege-escalation flaw in the Malware Protection Engine (1.1.26030.3008 and earlier) abusing improper link resolution to obtain SYSTEM-level access, and CVE-2026-45498 ('UnDefend'), a denial-of-service issue

✓ verified
READ THE FILE ›
Cyber desk illustration
Generated desk illustration · not a photograph
CYBER · SCOOP 55

Alleged Kimwolf IoT botnet operator 'Dort' arrested in Ottawa, charged in US and Canada

Per KrebsOnSecurity's May 21 report, Canadian authorities arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast-spreading Internet-of-Things botnet that enslaved millions of devices for a series of massive DDoS attacks over the prior six months. Krebs had publicly named the suspect in February 2026 after

✓ verifiednewSOURCE ↗
READ THE FILE ›

The morning wire in your inbox — every brief, primary sources linked, no noise.

Free tier. The Wire — continuous desk briefs · Records archive · Bureau alerts.

Stored to the wire's subscriber list. No spam, unsubscribe any time.