Lucid Flawlessly Hijacks iMessage: Encrypted Phishing Threats on iPhone

At a glance

• How Lucid works: Lucid is a phishing-as-a-service platform that sends scam texts through iMessage and Android’s RCS messaging.
• Global Implications: Researchers say it has targeted 169 organizations’ customers in 88 countries.
• Industry Response: Security researchers have published indicators so defenders can block it.
• User Vigilance: Treat unexpected texts about tolls, parcels or taxes with suspicion on any phone.

A phishing service built on encrypted messaging

Security firm PRODAFT has exposed Lucid, a phishing-as-a-service platform run by a Chinese-speaking group known as XinXin. Lucid sells criminals a ready-made way to send scam messages through Apple’s iMessage and Google’s RCS messaging on Android. It doesn’t break iMessage’s encryption. It abuses the fact that these messages are end-to-end encrypted, so carriers can’t scan them for spam the way they scan ordinary SMS.

The messages usually impersonate postal and courier services, toll operators, tax agencies and banks, pushing victims to fake pages that collect personal details and card numbers. PRODAFT said Lucid had targeted 169 entities in 88 countries. Phishing-as-a-service means the buyers don’t need technical skill.

How the scams get through

Lucid’s operators use large numbers of temporary Apple IDs and phone numbers, and device farms full of phones, to send messages at scale. Because iMessage and RCS traffic is encrypted, the texts skip the filters carriers use to catch SMS phishing. The operators also rotate domains and numbers to stay ahead of blocklists.

To get around iMessage’s protection against links from unknown senders, the scam messages often ask the recipient to reply, which can make the link clickable.

Encryption cuts both ways

Hundreds of millions of people use iMessage and RCS, so the reach is huge. The bigger lesson is that encryption protects attackers’ messages from carrier filtering just as it protects users’ privacy.

Platforms like Lucid lower the bar for criminals, who can rent the tools and templates instead of building their own.

How defenders are responding

PRODAFT published indicators of compromise so security teams and providers can block known Lucid infrastructure. Apple and Google offer ways to report junk messages, which helps them spot abusive accounts.

Defenders face a hard trade-off: they need to stop scams without weakening the encryption that protects everyone’s messages.

How to protect yourself

Your own caution is the best defense. Keep your phone updated, and be suspicious of messages about unpaid tolls, missed deliveries or tax refunds, especially from numbers or email addresses you don’t recognize.

Don’t reply to these messages, and don’t click their links. Go to the company’s official website or app instead.

Simple steps to stay safe

– Keep iOS updated so you have the latest security fixes. – Be wary of unsolicited messages, even if they look official; verify through the company’s own app or website. – Use your phone’s junk filtering and report scam messages. – Learn the common phishing tactics so you can spot them.

What Lucid shows about messaging scams

Lucid shows how criminals can turn encrypted messaging against its users. Tech companies and researchers are working to counter it, and users need to stay alert.

The lesson for everyone is the same: a text that creates urgency and asks you to click or pay is a warning sign, whatever app it arrives in.

The case also adds to the debate about how to balance privacy and security in messaging.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.