Lucid PhaaS With 17,500 Phishing Domains Mimics 316 Brands From 74 Countries

The cybersecurity landscape faces a growing threat from sophisticated Phishing-as-a-Service (PhaaS) platforms that are democratizing cybercrime by lowering technical barriers for fraudsters worldwide.

Among these emerging threats, the Lucid PhaaS platform has established itself as a formidable force in the underground economy, enabling massive-scale phishing operations across multiple continents and industry sectors.

Security researchers have uncovered an extensive criminal infrastructure centered around Lucid PhaaS, which has successfully deployed over 17,500 phishing domains targeting 316 prominent brands spanning 74 countries.

This scale represents one of the largest documented PhaaS operations to date, demonstrating the platform’s sophisticated capabilities and widespread adoption among cybercriminals.

The operation encompasses diverse industries including financial institutions, government agencies, postal services, and toll companies, indicating the platform’s versatility in mimicking various organizational structures and brand identities.

The campaign’s geographical reach extends from major financial centers in North America and Europe to emerging markets across Asia, Africa, and Latin America, suggesting a coordinated global operation rather than isolated regional activities.

Netcraft analysts identified the malware through advanced fingerprinting techniques and correlation analysis that linked Lucid to its companion platform, Lighthouse PhaaS, through shared anti-monitoring infrastructure and identical template systems.

The investigation revealed that Lucid operates through a subscription-based model where cybercriminals pay monthly fees for access to pre-configured phishing templates and hosting infrastructure.

Each phishing template within the platform receives a unique identifier, such as the “kuda295” theme discovered during analysis of a financial institution impersonation campaign.

This naming convention allows operators to efficiently manage multiple concurrent campaigns while maintaining operational security.

Advanced Evasion and Anti-Monitoring Mechanisms

Lucid PhaaS employs sophisticated detection evasion techniques that represent a significant evolution in phishing technology.

The platform implements a multi-layered filtering system that protects malicious content from security researchers and automated detection systems through several technical mechanisms.

The primary evasion technique requires visitors to access specific URL paths, such as “/servicios,” which are dynamically configured by fraudsters and vary significantly across campaigns targeting identical brands.

This path-based filtering makes automated detection challenging, as security systems cannot predict the required access patterns.

Additionally, the platform enforces geographical restrictions by requiring connections from specific proxy countries, effectively limiting exposure to security researchers operating from known analysis centers.

User-Agent filtering represents another critical evasion layer, with Lucid requiring mobile device signatures to display phishing content.

This restriction aligns with the platform’s targeting strategy, as mobile users often exhibit reduced security awareness and operate on devices with limited security tooling.

When visitors fail to meet these criteria, Lucid displays convincing fake e-commerce storefronts featuring products like shoes or women’s clothing, complete with professional layouts and product catalogs.

These anti-monitoring pages serve a dual purpose by maintaining the illusion of legitimate commerce while concealing the underlying criminal infrastructure.

Security researchers analyzing suspicious domains encounter apparently benign shopping websites, potentially causing them to classify the domains as false positives.

This deception technique significantly extends the operational lifespan of malicious domains and reduces the likelihood of successful takedown efforts.

The sophisticated fake storefronts demonstrating the platform’s attention to visual authenticity and user experience design, making detection increasingly challenging for both automated systems and human analysts.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.