"a fundamental move away from static password harvesting towards real-time interception and tokenization," Google Threat Intelligence Group (GTIG) warns.
Real-time interception and tokenization as the operational goal
GTIG's analysis of a dozen current Chinese-language phishing-as-a-service (PhaaS) offerings finds a deliberate shift in attacker objectives. Rather than stopping at stolen credentials, operators now aim to capture one-time passcodes (OTPs) in real time and use those credentials to provision victims' payment cards into attacker-controlled digital wallets. GTIG describes this shift as moving the goal from "simply gaining account access" to securing "direct, unauthorized control over a victim's financial accounts" through tokenization of payment instruments.
This approach depends on interactive phishing infrastructure: when a victim enters credentials on a live phishing page, those inputs are displayed instantly on an administration panel, allowing an operator to trigger and capture the target's OTP as it is produced. Once a card is tokenized into a digital wallet on an attacker-controlled device, it can be used for high-value transactions, contactless payments, and ATM withdrawals, according to GTIG.
Delivery via encrypted messaging: RCS and iMessage
GTIG highlights a tactical preference among Chinese-language PhaaS operators for Rich Communication Services (RCS) and Apple's iMessage over traditional SMS. These protocols provide end-to-end encryption and richer engagement features—read receipts, typing indicators, high-resolution media and larger files—that make lures appear more legitimate and harder for network-based filters to inspect. GTIG notes that this moves the emphasis for defense onto on-device protections, since server-side delivery infrastructure may be unable to inspect encrypted messages effectively.
Localization-as-a-service: YY Lai Yu and the expansion into 119 countries
GTIG documents services that provide not only phishing templates but localization at scale. One named example, YY Lai Yu (YY来鱼), first advertised in August 2024 and managed by a core team including "YY Lai Yu," "Jeffrey Carrie," and "Very casual," illustrates the model. Since November 2025 YY Lai Yu has offered more than 400 phishing templates and supports operations across 119 countries, with a particular focus on Japan.
In Japan-targeted campaigns GTIG observed templates impersonating local transit, payment apps, e‑commerce, gaming and financial services—naming brands such as Amazon, Apple, PayPay, JCB Card, JR (Rail), Mercari, Rakuten Securities, and many others. The operators went beyond account-login lures to exploit local consumer habits—deploying scams themed around loyalty points ("points" / 积分) redemption and even cost-of-living issues such as a "Japan Winter Electricity Subsidy." To evade automated analysis, some phishing chains included a human verification anti-bot screen that required a manual click before displaying the phishing page.
YY Lai Yu's administration panel, GTIG reports, allows customers to query phished data, blocklist or prefer certain BIN ranges, register and manage domains (including via Alibaba's domain registration service), and control user permissions—functionality that institutionalizes scale and operational management.
Automation, AI, and the evolution of stealth: Darcula and UNC5814
GTIG observed multiple PhaaS operators integrating AI and browser automation tools to defeat signature-based detection. The Darcula PhaaS platform—linked by GTIG to UNC5814—has moved from static templates to AI-powered page generators and uses tools like Puppeteer to clone legitimate sites' HTML, CSS, JavaScript and visual elements from a target URL. GTIG says this produces unique pages for each campaign, reducing the efficacy of static-detection signatures and increasing the difficulty of automated takedown.
Beyond page generation, GTIG describes an extensive ancillary market tied to these platforms: the sale of personally identifiable information (PII), VPS hosting and server rentals, domain registration, money laundering services, IMSI-catcher eavesdropping devices, spamming/ message-sending services, and trading in stolen payment-card information—creating a nearly end-to-end criminal ecosystem.
What this means for technologists, banks, and the public
- Technologists and security teams: GTIG recommends moving defenses beyond user training toward technical controls such as FIDO2/WebAuthn, which it identifies as a countermeasure to real-time OTP interception. GTIG also suggests pairing enterprise authentication upgrades with risk-based verification and device fingerprinting during digital wallet provisioning.
- Issuing banks and payment platforms: the report calls for stronger verification during tokenization processes and for banks to incorporate device and risk signals when an attempt is made to provision a card into a new digital wallet, given the operators' explicit monetization focus on payment-card tokenization.
- End users and the general public: GTIG's findings underline that standard phishing hygiene remains necessary but insufficient; encrypted, lifelike messages over RCS and iMessage can make social-engineering lures appear legitimate, and attackers are actively targeting lifestyle services and loyalty programs as well as traditional banking.
GTIG also reports that Chinese-language PhaaS operators commonly advertise on Telegram—often openly, with images of luxury lifestyles—and that these services tend to mimic non-Chinese organizations and rarely target China directly. Google took legal action against one PhaaS provider "late last year" and has been working to endorse legislation and enact technical safeguards against such scams.
GTIG's central observation is operational: as Chinese-language PhaaS platforms combine real-time interception, encrypted delivery channels, AI-driven page generation, and a full suite of ancillary criminal services, defenders must make stolen credentials technically unusable rather than rely solely on detection. The practical steps GTIG names—FIDO2/WebAuthn, risk-based verification, device fingerprinting—are specific countermeasures geared to the new criminal objective of rapid tokenization and wallet provisioning.
