Holiday Season Phishing Surge: Fake Rewards, Tax Refunds, and Retail Scams Hit US Consumers
In late 2025, a surge of SMS phishing campaigns originating from China-based threat actors targeted US consumers, leveraging fake rewards, tax refund lures, and convincing e-commerce storefronts. Attackers registered thousands of new phishing domains, deploying convincing T-Mobile and AT&T spoof sites promoted via iMessage and RCS. Victims, enticed to enter payment card data and one-time codes, unknowingly enabled attackers to enroll their cards into Apple or Google mobile wallets under fraudster control, facilitating rapid monetization of stolen credentials. These operations exploited seasonal shopping urgency and sophisticated phishing kits to evade detection, causing widespread financial fraud, identity theft, and downstream losses for individuals and financial institutions. The incident highlights a global shift in phishing techniques, with threat actors now employing advanced, rapidly deployable kits and mobile wallet fraud vectors. The proliferation of fake e-commerce and tax-refund scams demonstrates increased operational agility and a focus on bypassing traditional browser-based defenses, raising urgent concerns for both consumer security and enterprise payment protection.
Kill Chain
