236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers
236,000 DCloud Uni-App sites used for crypto scams, phishing, and wallet drainers.
Infoblox discovered over 236,000 websites leveraging DCloud Uni-App, a legitimate Chinese open-source framework, to power investment scams, crypto wallet drainers, phishing operations, and brand-impersonation sites. The fraudulent campaigns have been active since mid-2022, targeting speakers of at least eight languages across every continent. Unknown threat actors appear to be selling DCloud scam templates, with signs of both centralized ownership and multiple unrelated operators running distinct scam populations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Infoblox?
Get an email when a new story names Infoblox, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are exploiting DCloud Uni-App, a legitimate open-source framework, as a ready-made infrastructure for running investment fraud, phishing, and crypto wallet drainer campaigns at massive scale. The root issue is that legitimate developer tooling and hosting platforms can be weaponized and resold as scam-as-a-service kits, lowering the barrier for criminal operators globally. This matters because victims across every continent are being deceived by convincing brand-impersonation sites built on trusted frameworks, making detection harder for both users and defenders. The longevity of this campaign — active since mid-2022 — underscores how slow the response to platform abuse can be when it spans multiple jurisdictions and operators.
What helps against this
How we list vendors- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — whats-zwp.vip
- domain — faq-whatsapp-center.com
- malware — RainbowEx