Infoblox researchers say the open-source DCloud Uni-App framework has been widely abused to build more than 236,000 scam sites, with millions of enterprise connection attempts showing how consumer fraud is increasingly spilling into corporate networks.
A Chinese open-source application framework has emerged as the foundation of a vast global scam ecosystem, with researchers linking it to more than 236,493 fraudulent websites that are increasingly reaching enterprise networks.
According to Infoblox Threat Intel, the open-source DCloud Uni-App framework has allegedly been abused to create a wide range of scam platforms, including fake cryptocurrency exchanges such as RainbowEx, pig-butchering scams, WhatsApp phishing campaigns, fake gambling sites, brand impersonation websites and cryptocurrency wallet drainers. The research stresses that the framework itself is a legitimate open-source technology, but has been repurposed by cybercriminals to build scalable scam operations.
The impact is extending into businesses. Infoblox recorded more than five million attempted connections from 985 organisations across 25 industries to the identified scam infrastructure. Rather than originating from a single victim, the activity consisted of numerous small visits by employees, often after clicking links shared through WhatsApp, Telegram, social media or personal devices connected to workplace networks.
Researchers also found that RainbowEx was not an isolated operation but part of a reusable template built on the DCloud framework. Similar fraud operations continue to emerge even after earlier schemes are dismantled, with Yuechi Sharing Technology Ltd. reportedly following the model of the FBI-investigated Lightning Shared Scooter Co.
“This is no longer just a consumer fraud problem. When scam traffic reaches work devices and work networks, companies inherit the fallout, from employee losses to possible data exposure and tougher scrutiny from leadership,” said Zach Edwards, Staff Threat Researcher at Infoblox.
The findings underscore how legitimate open-source technologies can be misused at scale, reinforcing that security depends on how software is used rather than whether it is open source.
