[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX5wRwvgRvflzwAPNPXDmsUdDnMrNza5HZLNhmPsbQ8w":3},{"article":4,"iocs":53,"watch_terms":62,"solutions":63,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"0c2a9ec0-4d58-4d06-848e-fb6779e7fed4","236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers","236-000-dcloud-uni-app-sites-used-in-crypto-scams-phishing-and-wallet-drainers-8ca2d5","New findings unearthed by Infoblox show that more than 236,000 websites are using investment scam templates built using a legitimate Chinese open-source, cross-platform application development framework called DCloud Uni-App. The templates power bogus cryptocurrency exchanges, multi-language pig-butchering operations, WhatsApp phishing networks, fake gambling platforms, brand-impersonation","Infoblox discovered over 236,000 websites leveraging DCloud Uni-App, a legitimate Chinese open-source framework, to power investment scams, crypto wallet drainers, phishing operations, and brand-impersonation sites. The fraudulent campaigns have been active since mid-2022, targeting speakers of at least eight languages across every continent. Unknown threat actors appear to be selling DCloud scam templates, with signs of both centralized ownership and multiple unrelated operators running distinct scam populations.","236,000 DCloud Uni-App sites used for crypto scams, phishing, and wallet drainers.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002F236000-dcloud-uni-app-sites-used-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhK82zgZh0edVIi1z4Rs0V9v_8tn_Mh_X6_H5TQYnFwEtbrE1dhjw5Z-9U99Lojet5RdcrIgwJK0bZusY4u22qKVFBzpCuHihAzXd4RNuJQGSxEfdNlBH4GFZYedXXohyQdbfNYIxr9LV6KFgUyX3CWVjfsOiIQRq3JEXmGRrR9afqsfMoeR-BH_kZmTCKd\u002Fs1600\u002Fphish-uni.jpg","2026-06-29T11:57:40+00:00","2026-06-29T14:00:23.145253+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"DCloud Uni-App","technology",{"name":21,"type":22},"Infoblox","vendor",{"name":24,"type":25},"RainbowEx","campaign",{"name":27,"type":19},"BNB Chain",{"name":29,"type":19},"Tether",{"name":31,"type":19},"Polymarket","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,60],{"type":55,"value":56,"context":57},"domain","whats-zwp.vip","WhatsApp phishing domain impersonating Security Help Center",{"type":55,"value":59,"context":57},"faq-whatsapp-center.com",{"type":36,"value":24,"context":61},"Bogus cryptocurrency exchange running Ponzi scheme affecting San Pedro, Argentina residents; seven operators arrested in late 2024",[21],{"controls":64,"vendors":149},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"slug":95,"name":96,"problem":97,"products":98},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":124,"name":125,"problem":126,"products":127},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[128,136,142],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":137,"product_name":138,"url":140,"description":141},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":124,"product_name":146,"url":147,"description":148},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":164},"236000-fraudulent-dcloud-sites-drive-global-crypto-scam-wave","236,000 Fraudulent DCloud Sites Drive Global Crypto Scam Wave","Threat actors are exploiting DCloud Uni-App, a legitimate open-source framework, as a ready-made infrastructure for running investment fraud, phishing, and crypto wallet drainer campaigns at massive scale. The root issue is that legitimate developer tooling and hosting platforms can be weaponized and resold as scam-as-a-service kits, lowering the barrier for criminal operators globally. This matters because victims across every continent are being deceived by convincing brand-impersonation sites built on trusted frameworks, making detection harder for both users and defenders. The longevity of this campaign — active since mid-2022 — underscores how slow the response to platform abuse can be when it spans multiple jurisdictions and operators.",[155,156,157,158,159,160,161,162,163],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","NIST CSF PR.AT-1 – Awareness and Training","NIST CSF DE.CM-7 – Monitoring for Unauthorized Activity","NIST SP 800-161 – Supply Chain Risk Management","GDPR Article 32 – Security of Processing (for EU-facing brand impersonation impact)","ITIL v4 – Service Configuration Management (third-party tooling governance)","NIST SP 800-150 – Guide to Cyber Threat Information Sharing",{}]