Researchers from Cyjax have published a report on how a financially motivated threat group known as “Fangxiao” is conducting a massive website spoofing campaign, having built a network of approximately 42,000 domains. The domains mimic very popular brands like Coca Cola, Emirates, McDonalds, and many more as the campaign spoofs entities in the retail, banking, travel, pharmaceuticals, transport, financial, and energy sectors. This campaign appears to function as a traffic generation scam to earn ad revenue for the threat group’s own sites, as well monetizing the user data of victims unlucky enough to arrive at one of their honeypot domains. According to the researchers monitoring Fangxiao’s activity, the threat group is registering approximately 300 new spoofed domains per day. To add insult to injury, some of the sites contain redirect queries that bring the victims to sites hosting malware like the “Triada” trojan. Users are initially brought to the fake sites through interacting with mobile advertisements or being the victim of WhatsApp phishing attacks with embedded malicious links leading to the group’s spoofed landing pages. Fake survey domains are also prevalent, often having timers that create a sense of urgency so that the victim has less time to be suspicious. Upon completion of the survey the victims may be asked to download a malicious application to collect their “reward,” registering them as a new Fangxiao referral user. The Cyjax report contains several credible indicators for tactics, techniques, and procedures (TTPs), utilized by Chinese threat groups. This includes authoring their bait sites/ads in Mandarin as well as utilizing email addresses attributed to Chinese threat actor accounts on known hacking forums. CTIX analysts will monitor the fallout from this campaign and continue to report on breaking and novel TTPs utilized in cybercriminal activity.