ThreatVectr

236,000 Sites Run Pig-Butchering Templates Built on DCloud Uni-App

Infoblox researchers tie a sprawling fake-exchange and wallet-drainer ecosystem to a legitimate Chinese cross-platform dev framework.

ThreatVectr NewsdeskUpdated · Editor: Lee Brown· 3 min read
236,000 Sites Run Pig-Butchering Templates Built on DCloud Uni-App
Share

Key points

  • Infoblox has mapped more than 236,000 websites running investment-scam templates built on DCloud Uni-App, a legitimate Chinese open-source framework.
  • The kits power fake cryptocurrency exchanges, multilingual pig-butchering operations, WhatsApp phishing funnels, and wallet drainers.
  • Wallet-drainer variants hook into WalletConnect and request token approvals on first interaction, before any deposit is made.
  • There is no CVE and no patch: this is framework abuse, which makes takedown slow and jurisdiction-dependent.
  • Blue teams should prioritize DNS and proxy-layer detection and pull Infoblox's published indicators into blocklists.

What is DCloud Uni-App and why does it matter here?

DCloud Uni-App is a legitimate Chinese open-source framework that compiles a single Vue.js codebase into web, iOS, Android, and several Chinese mini-program runtimes. For scam operators, that reach is the point: one template, every surface a potential victim might land on. The framework itself is not the problem. What Infoblox found is an industrialized supply chain layered on top of it, complete with template marketplaces, repackaged builds, and heavy DNS reuse across clusters.

How do these scam templates actually work?

The fake-exchange templates include working order-book animations and a deposit flow that accepts cryptocurrency but never permits withdrawal. That's the core pig-butchering mechanic. WhatsApp phishing flows route victims through Uni-App-rendered landing pages before handing them off to human operators on messaging apps. Brand impersonation extends beyond crypto into retail and gambling, which broadens the victim pool well past crypto-native users.

Should you worry about these sites surviving a basic check?

Many of the 236,000-plus domains impersonate real exchanges or financial brands convincingly enough to pass a quick look at the URL bar. The volume alone is the threat: at that scale, even a low conversion rate funds significant criminal infrastructure. Our earlier coverage of DOJ action against the HuiOne network on 24 June 2026 showed how pig-butchering proceeds flow through layered corporate structures once victims are in; this Infoblox research describes the front end of that same pipeline.

What can defenders do right now?

Infoblox is publishing indicators tied to the template clusters. Defenders running DNS-based filtering, a layer that blocks malicious domains before a connection is established, should pull those into blocklists and watch for newly registered domains resolving into the same hosting ranges. Email and SMS gateways should treat WhatsApp-redirect landing pages with the same suspicion as credential-phishing kits.

The harder problem is structural. DCloud isn't responsible for what people build on its framework, and the hosting and DNS infrastructure is scattered across providers with wildly different abuse-response timelines. No single takedown fixes this. Detection at scale is the realistic answer for now.

If an exchange you've never heard of slides into your DMs offering guaranteed returns, close the tab.

Infoblox credits its threat-intelligence team for the discovery; the firm had not named individual researchers in its public writeup at time of publication.

Latest stories

A close-up, edge-to-edge 16:9 photograph of a Windows desktop computer screen glowing in a dim office at night, displaying a waveform audio editing interface wi
Threat Intelligence

SectopRAT Hidden Inside Legitimate Audio Software to Steal Passwords and Take Remote Control

Fortinet's incident responders found a powerful remote-access trojan tucked inside a tampered copy of a real audio program. The malware can grab browser passwords, watch your screen, and hand full control of a Windows PC to criminals.

Sep 25
Photoreal editorial shot of a dimly lit industrial control room, rows of SCADA monitors showing abstract pipeline and grid schematics glowing blue and amber, on
Threat Intelligence

FBI warns foreign hackers raided a US industrial contractor for SCADA blueprints

A March-April 2025 intrusion at an industrial automation firm netted around 800 files on power and transport customers, and the FBI is telling critical infrastructure to rethink how much access it hands to outside integrators.

Sep 23
Full-frame edge-to-edge photoreal news-editorial shot of a dark workshop desk with a single unlit Windows laptop screen glowing pale blue, four small identical
Threat Intelligence

Malware Lets Four AI Models Vote on What to Steal Next

Cisco Talos found a Windows sample that hands its decisions to a small panel of AI models. The lab copy does not run, but the idea is the story.

Sep 23
A glowing cluster of interconnected nodes arranged in a voting pattern against a deep navy background, each node pulsing with faint electric-blue light, thin da
Threat Intelligence

CLOSEDQUORUM Runs Its Own Attack Without Asking Anyone

Cisco Talos has identified what it calls the first fully autonomous command-and-control implant: malware that polls a panel of AI models to decide its next move and never checks back with its operator.

Sep 23
© 2026 Threat Vectr