New Wave of Phishing Scams – Fraudsters Posing as DMV to Steal U.S. Citizen Data

A sophisticated and widespread phishing campaign, emerging in May 2025, has targeted U.S. citizens by impersonating state Departments of Motor Vehicles (DMVs).

Leveraging deceptive SMS messaging and cloned web infrastructure, attackers have harvested personal and financial information from unsuspecting individuals.

The campaign, notable for its scale and use of official-looking imagery, highlights the growing threat of organized cybercrime and underscores the urgent need for heightened awareness and enhanced security measures.

Elaborate Smishing Tactics and Domain Cloning

Victims received alarming SMS messages, ostensibly from local Department of Motor Vehicles (DMV) agencies, warning of unpaid toll violations and threatening license suspension or legal action.

The messages often referenced fictitious legal codes, such as “[State-Name] Administrative Code 15C-16.003,” to enhance credibility.

Clicking the embedded links led to meticulously crafted fake DMV websites, each customized to resemble the victim’s home state and prompting users to pay a supposed fine.

These fraudulent sites then solicited extensive personal and financial information, including full names, addresses, email addresses, phone numbers, and credit card details.

Technical analysis revealed a highly organized operation. Malicious domains frequently followed the pattern: https://[state_ID]dmv.gov-[4-letter-string].cfd/pay
or used similar structures with TLDs like .cfd and .win, chosen for their low cost and ease of registration.

The campaign’s infrastructure shared a common IP address (49.51.75[.]162). It hosted a set of six HTML files, each tailored to a different state: Pennsylvania, Georgia, Texas, California, New Jersey, New York, and Florida.

Notably, phishing sites hosted on disparate IPs still shared the same HTML designs, indicating the use of a centralized phishing kit.

Attribution and Technical Indicators Point to China-Based Threat Actors

All malicious domains employed AliDNS (alidns.com, dns8.alidns.com) for DNS services, with SOA contact addresses linked to hichina.com a marker for Chinese domain administration.

Source code and digital asset fingerprints further confirmed the campaign’s origins, as every phishing site used the same JavaScript (C18UmYZN.js, fliceXIj.js), CSS (C0Zfn5GX.css), and image files, often including state logos.

Chinese-language comments embedded in the code and the use of a widely recognized phishing kit Lighthouse strongly suggested a China-based threat actor with access to phishing-as-a-service tools.

The FBI’s Internet Crime Complaint Center (IC3) received over 2,000 complaints in a single month, with industry experts estimating many more incidents went unreported.

In response, federal and state authorities issued urgent advisories, urging the public to ignore suspicious messages and report them promptly.

Defensive Measures and Public Awareness

To combat this threat, individuals are advised never to trust unsolicited messages requesting payment or personal data and to visit official DMV websites directly.

Organizations should block high-abuse TLDs at the DNS level and implement email authentication protocols (DMARC, SPF, DKIM).

Threat intelligence teams are encouraged to integrate the provided indicators of compromise (IOCs) into their defensive systems and share these IoCs via platforms like MISP.

As this campaign demonstrates, the combination of social engineering, technical deception, and infrastructure automation makes phishing a formidable and growing risk.

Vigilance, education, and coordinated threat intelligence remain critical tools in defending citizens and organizations from such attacks.