The Group-IB research report reveals the existence of the "Phoenix System," an advanced Phishing-as-a-Service (PhaaS) platform used in global smishing campaigns across regions such as APAC, LATAM, Europe, and MEA. This platform facilitates cybercriminals by offering integrated tools for real-time victim monitoring, geofencing, and live intervention to bypass multi-factor authentication. Since January 2025, a notable increase in smishing campaigns has been observed, particularly targeting sectors like financial services, logistics, and telecommunications, with over 2,500 phishing domains identified and more than 70 organizations affected.